Book Video Maker

• Outcome: Review
• Latest audit: May 28, 2026 · 11:22 AM UTC
• Version: 2.0.0

Overview

The skill appears to generate book videos as advertised, but it automatically installs Python packages and looks for API keys in extra local places beyond the main documented setup.

Review before installing. Run it only in a virtual environment, install dependencies yourself from trusted pinned versions, use a dedicated low-privilege ARK/Doubao API key, and avoid private book notes or sensitive quote text because prompts and text are sent to external services.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import edge_tts
    import requests
except ImportError:
    subprocess.check_call([sys.executable, "-m", "pip", "install", "edge-tts", "requests", "-q"])
    import edge_tts
    import requests

• Confidence: 97% confidence
• Finding: Automatically installing packages at runtime modifies the environment and executes code fetched from external package repositories without explicit user approval. In a skill context, this increases supply-chain risk and can unexpectedly change the host system, especially if package indexes, mirrors, or dependency resolution are compromised.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

else:
            vf = f"scale=1188:2112,crop=1080:1920:50:192-t*60,{title_f},{cn_f},{en_f}"
        
        subprocess.run(["ffmpeg", "-y", "-loop", "1", "-i", str(bg), "-t", str(dur), "-vf", vf, "-c:v", "libx264", "-pix_fmt", "yuv420p", "-r", "30", str(out)], capture_output=True)
        if out.exists() and out.stat().st_size > 1000:
            videos.append(out)
        print(f"  [{i+1}/{len(segments)}] {dur:.2f}s")

• Confidence: 75% confidence
• Finding: The ffmpeg filter graph includes text derived from user-controlled book title, author, and JSON segment content, but escaping is incomplete and only applied to some fields. This can let crafted input break filter syntax, cause unexpected ffmpeg behavior, or reference unintended resources in complex filter parsing contexts, making it an output-injection issue rather than classic shell injection.

Tainted flow: 'img_url' from requests.post (line 87, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

r = requests.post(ARK_API_URL, headers=headers, json=payload, timeout=120)
        if r.status_code == 200:
            img_url = r.json()["data"][0]["url"]
            img_r = requests.get(img_url, timeout=30)
            if img_r.status_code == 200 and len(img_r.content) > 10000:
                Path(output_path).parent.mkdir(parents=True, exist_ok=True)
                with open(output_path, "wb") as f:

• Confidence: 93% confidence
• Finding: The script blindly fetches a URL returned by a remote API and treats the response as an image without validating the scheme, host, content type, or size beyond a minimal length check. This can enable SSRF-like behavior, unexpected internal network access, or retrieval of maliciously large or malformed content if the upstream service is compromised or manipulated.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The script searches both environment variables and ad hoc local markdown files for API keys, expanding credential access beyond the minimum needed and increasing the chance of unintended secret use. In an agent skill, undeclared credential discovery is risky because it can consume secrets present for unrelated tools or workflows.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: Runtime package installation gives the script environment-modification and code-fetching capability that is broader than simple media generation. In managed agent environments, this is dangerous because it can bypass dependency review, introduce supply-chain exposure, and alter the runtime unexpectedly.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill accesses API credentials from environment variables and local files without clearly warning the user at the point of use. While this may support legitimate functionality, undisclosed secret access in a skill increases trust and governance risk and makes misuse harder to detect.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script sends prompts and authorization credentials to an external service without any explicit runtime disclosure or consent flow. In a skill ecosystem, that lack of transparency matters because user-provided content and secrets leave the local environment silently.

Static analysis

No suspicious patterns detected.