Wjs Overlaying Video

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:20 AM UTC
• Version: 0.1.0

Overview

This video overlay skill is mostly coherent, but it has real review concerns because it can force fixed branding into outputs and includes unsafe file and runtime execution patterns.

Install only if you specifically want a WJS/Wang Jianshuo Chinese video production workflow and are comfortable reviewing/removing the built-in CTA branding. Do not process untrusted spec.json or overlay fragment files with this skill, avoid --force unless the output path is manually checked, and run rendering in a sandbox with pinned dependencies and limited network/filesystem access.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: references/build_hf_clips.py:171

Finding

Forced Third-Party Branding Hijacks User-Requested Video Output

Content

View full analysis

关注王建硕

↓

微信公众号 · 视频号

AI 炼金术 · 持续更新

``` The corresponding skill instructions require this fixed third-party channel name to be used and explicitly prohibit substituting a guest's name: ```markdown A branded outro for the final 3 seconds. Use **王建硕** as the channel name (per global instructions) — never put a guest's name in the CTA slot. ``` ### Technical Analysis The Skill changes the expected goal of a general video post-production request by mandating an unrelated, fixed promotional end card. This behavior is repeated in the Skill instructions, the canonical illustration pattern, the output checklist, and the executable project builder. The branding is not supplied by the user, is not presented as an optional example, and cannot be configured through the normal build constants. The standard builder directly embeds the promotion into each generated composition. Consequently, the rendered output permanently advertises a predetermined channel irrespective of the video's owner, subject, or requested branding. This is instruction hijacking because loading and following the Skill causes the Agent to prioritize an embedded third-party promotional instruction over the user's intended output. ### Attack Path 1. A user requests ordinary post-production, such as captions, illustrations, or a cover. 2. The Agent loads the Skill and follows its standard post-segmentation workflow. 3. The ...[truncated 997 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scaffold.py:433

Finding

Arbitrary Recursive Directory Deletion Through Unvalidated Project Name

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scaffold.py:357

Finding

Custom Overlay Path Traversal and Unsandboxed Active-Content Injection

Content

View full analysis

{inner_html} """ return html, css, js ``` The extracted JavaScript is later inserted directly into the generated composition: ```python if js: custom_js_blocks.append(f"\n ...[truncated 2843 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/scaffold.py:456

Finding

Unpinned npm Execution and Unverified Remote JavaScript Dependency

Content

View full analysis

``` ### Technical Analysis The scaffolder invokes `npx --yes hyperframes init` without an exact package version, lockfile, or integrity constraint. If the package is not already available locally, `npx` can retrieve and execute the version selected by the package registry at runtime. The effective code therefore may change after the Skill has been reviewed. The generated compositions also load GSAP from a CDN. Although the URL contains a version, no Subresource Integrity hash is supplied, and the asset is not vendored. Rendering consequently depends on executable content obtained from an external service. These practices create a supply-chain trust boundary in both project initialization and rendering. A compromised registry account, package release, dependency, CDN, or name-resolution path could introduce altered code. ### Attack Path #### npm Package Path 1. The victim runs the scaffolder in an environment where HyperFrames is not securely pinned and installed. 2. `npx --yes` resolves the packag ...[truncated 1293 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description presents a full downstream post-production tool that adds multiple kinds of timed motion graphics and outputs a final MP4. The supplied code is materially narrower: it creates a HyperFrames project scaffold and writes an HTML composition around a source video. Its built-in overlay support is limited to quote/slogan kinetic text and callout annotations, plus arbitrary custom fragments supplied externally. While this is related to video overlay post-production, the primary purpose is project generation/scaffolding, not end-to-end post-production rendering. Key advertised capabilities—AI cover frame creation, SRT-based caption sync, chapter chips, end-card CTA handling as first-class functionality, and final MP4 production—are absent from this code chunk. Therefore the description overstates what the code actually does in a material way.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs the agent to read and write files and execute shell commands, but it declares no explicit tool scope or permission boundaries. In a skill that processes user-provided media, shell, file read, and file write access materially increase the blast radius if prompts, paths, or referenced assets are attacker-controlled.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description enumerates activation phrases largely in Chinese and frames the skill around Chinese-language post-production requests, but does not state that this locale restriction is optional or limited to a region-specific deployment. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The pipeline begins from clip.zh-CN.burn.srt, which embeds a Chinese locale assumption into the default workflow. Because the file does not explain that this is a region-specific skill or offer alternative subtitle locales, it reads as a forced locale default.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using npx hyperframes without pinning an exact package version allows resolution of whatever version is current at execution time. That creates a supply-chain risk: a compromised or breaking upstream release could execute unexpected code in the agent environment during lint, validate, inspect, or render steps.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using npx hyperframes without pinning an exact package version allows resolution of whatever version is current at execution time. That creates a supply-chain risk: a compromised or breaking upstream release could execute unexpected code in the agent environment during lint, validate, inspect, or render steps.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using npx hyperframes without pinning an exact package version allows resolution of whatever version is current at execution time. That creates a supply-chain risk: a compromised or breaking upstream release could execute unexpected code in the agent environment during lint, validate, inspect, or render steps.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using npx hyperframes without pinning an exact package version allows resolution of whatever version is current at execution time. That creates a supply-chain risk: a compromised or breaking upstream release could execute unexpected code in the agent environment during lint, validate, inspect, or render steps.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using npx hyperframes without pinning an exact package version allows resolution of whatever version is current at execution time. That creates a supply-chain risk: a compromised or breaking upstream release could execute unexpected code in the agent environment during lint, validate, inspect, or render steps.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 493)May include surrounding context.

md

- **`hyperframes`** — the underlying composition framework. This skill
  is a thin wrapper that encodes the proven post-production patterns;
  everything in the `hyperframes` skill applies (preview, render,
  transitions, audio-reactive, etc.). Read it whenever you write
  `custom` overlays.
- **`hyperframes-cli`** — the CLI commands the project uses
  (`init`, `lint`, `validate`, `inspect`, `render`).

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated output forces lang="zh-CN", Chinese subtitle input naming, and Chinese CTA/chapter text, which constitutes a language/locale constraint in natural-language content. The file does not offer user opt-in or indicate that this is a region-specific tool where the restriction is required.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The generated HTML unconditionally loads GSAP from a third-party CDN, which means rendering depends on remote code fetched at runtime rather than only local assets. If the CDN response is tampered with, blocked, or replaced, the rendering pipeline may execute untrusted JavaScript in the local rendering environment and produce compromised outputs or leak project data accessible to that environment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · references/build_hf_clips.py (reported line 240)May include surrounding context.

python

work = proj / "1080"
    if not work.exists():
        # init hyperframes scaffold
        subprocess.run(["npx", "hyperframes", "init"], cwd=proj, check=True,
                       stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    work.mkdir(exist_ok=True)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file contains user-facing overlay text in Chinese, such as the thought bubble and caption, and later recipes also use Chinese labels. Under the stated policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This manifest-like JSON file contains user-facing overlay text in Chinese at L13 and L29, but provides no indication that the language is optional, user-selected, or required for a region-specific purpose. Under the policy, forcing a specific language without opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Lines L228-L229 instruct authors to "always use 王建硕 as the channel name," which enforces a specific language/locale presentation. This is a natural-language policy concern because the file does not indicate user opt-in, alternatives, or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The script scaffolds projects via npx hyperframes without pinning an exact package version, allowing the latest registry-published package to be fetched and executed. If the package is compromised, typo-squatted, or a malicious version is published, running this skill can execute attacker-controlled code on the host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template hard-codes lang="zh-CN" in the generated HTML, which imposes a specific language/locale on all scaffolded projects regardless of user preference or project context. This is a natural-language policy concern because the file does not offer any locale choice or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Custom overlays allow arbitrary HTML, CSS, and especially JavaScript from user-controlled fragment files to be inlined into index.html, with direct access to the root GSAP timeline and browser execution context. Because this skill is explicitly for post-production overlay authoring, the feature is reachable by design, making XSS-like script execution and arbitrary behavior in the rendering pipeline a real and context-relevant risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This line executes npx --yes hyperframes init, which may download and run code from the package registry at runtime without version pinning. In an agent skill context, this is especially dangerous because simply invoking the skill can trigger remote code execution through a compromised dependency supply chain.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The scaffolding logic executes an external package-manager-mediated command as part of normal operation, which expands the trust boundary to npm and the HyperFrames package publisher. In this skill context, that behavior is not incidental: users are expected to run the scaffold, so exploitation would yield code execution on the system performing the render setup.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/scaffold.py (reported line 456)May include surrounding context.

python

# Run npx hyperframes init in the parent dir, capturing output.
        print(f"initializing HyperFrames project at {project_dir}…",
              file=sys.stderr)
        result = subprocess.run(
            ["npx", "--yes", "hyperframes", "init",
             "--name", name,
             "--width", str(width),

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python file hardcodes user-facing illustration labels and captions in Chinese across multiple clips, such as at L015-L095. The applicable policy forbids forcing a specific language without user opt-in, and there is no indication here of any locale selection, fallback, or documented region-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.