Security audit
Security checks for vulnerabilities and agentic risk
This video-generator skill mostly matches its stated purpose, but it automatically installs unpinned packages and handles API credentials with broader local file searching than users may expect.
Review this skill before installing. Use it only in an isolated environment, preinstall reviewed dependency versions yourself, provide a dedicated low-privilege Ark API key, avoid storing unrelated secrets in the searched markdown files, and treat quote JSON/book/author inputs as trusted until FFmpeg escaping is hardened.
scripts/generate.py:26Automatic Installation of Unpinned Python Dependencies
scripts/generate.py:161User-Controlled FFmpeg Filtergraph Injection
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
payload = {"model": ARK_MODEL, "prompt": prompt, "size": "1080x1920", "response_format": "url", "watermark": False}
try:
r = requests.post(ARK_API_URL, headers=headers, json=payload, timeout=120)
if r.status_code == 200:
img_url = r.json()["data"][0]["url"]
img_r = requests.get(img_url, timeout=30)
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
print(f" [OK]")
else:
print(f" [FAIL] 占位图")
subprocess.run(["ffmpeg", "-y", "-f", "lavfi", "-i", "color=c=gray:s=1080x1920:d=1", "-frames:v", "1", str(output)], capture_output=True)
paths.append(output)
time.sleep(1)
return paths
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
subprocess.run(["ffmpeg", "-y", "-f", "concat", "-safe", "0", "-i", str(concat), "-c", "copy", str(merged)], capture_output=True)
output = run_dir / "final.mp4"
subprocess.run(["ffmpeg", "-y", "-i", str(merged), "-i", str(voice_path), "-c:v", "copy", "-c:a", "aac", "-b:a", "192k", "-shortest", str(output)], capture_output=True)
return output
The natural-language content describing setup, parameters, and behavior is presented only in Chinese, which effectively forces a specific language on users. The file does not offer an alternative language, opt-in, or explain that the skill is intentionally region-specific.
The file's natural-language strings and configuration are centered on Chinese output, including the default voice zh-CN-YunxiNeural and hard-coded Chinese content generation, with no option presented for alternate language or locale behavior. This constitutes a language/locale policy concern because the skill enforces a specific language without user opt-in or documented justification.
Runtime auto-installation gives the script package-management capability that is broader than necessary for ordinary video generation and can execute unreviewed setup/install hooks. This is especially risky in agent or skill environments where users may not expect code to modify the Python environment or pull remote code.
Executing pip automatically and silently changes the environment and can run remote package code without consent. That is dangerous operationally and from a supply-chain perspective, especially when embedded in an agent skill that appears to only generate videos.
Automatically running pip install at script startup executes package-management actions and arbitrary package code without user consent. In a skill context, this expands the trust boundary to PyPI and can lead to supply-chain compromise or unexpected code execution during installation.
import edge_tts
import requests
except ImportError:
subprocess.check_call([sys.executable, "-m", "pip", "install", "edge-tts", "requests", "-q"])
import edge_tts
import requests
The script searches multiple local markdown files for API keys, including oddly named files unrelated to the visible task, expanding its access to local secrets beyond what users would reasonably expect. In a skill setting, silent credential discovery from arbitrary workspace files materially increases the risk of unintended secret harvesting.
The script reads API keys from environment variables and local files without clear disclosure, creating a secret-access behavior that may surprise users and administrators. Hidden secret collection is dangerous because it erodes informed consent and can expose credentials from files unrelated to this script's stated purpose.
The script transmits prompts and bearer credentials to an external image-generation service without an explicit user-facing warning. In a skill context, undisclosed external transmission is risky because prompts, metadata, and authorization tokens leave the local environment and may be retained by third parties.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
payload = {"model": ARK_MODEL, "prompt": prompt, "size": "1080x1920", "response_format": "url", "watermark": False}
try:
r = requests.post(ARK_API_URL, headers=headers, json=payload, timeout=120)
if r.status_code == 200:
img_url = r.json()["data"][0]["url"]
img_r = requests.get(img_url, timeout=30)
The script fetches a second URL taken directly from the remote API response without validating the hostname, scheme, or destination. If the upstream service is compromised or returns attacker-controlled URLs, this becomes a server-side request forgery style primitive that can contact unexpected internal or external resources.
r = requests.post(ARK_API_URL, headers=headers, json=payload, timeout=120)
if r.status_code == 200:
img_url = r.json()["data"][0]["url"]
img_r = requests.get(img_url, timeout=30)
if img_r.status_code == 200 and len(img_r.content) > 10000:
Path(output_path).parent.mkdir(parents=True, exist_ok=True)
with open(output_path, "wb") as f:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
print(f" [OK]")
else:
print(f" [FAIL] 占位图")
subprocess.run(["ffmpeg", "-y", "-f", "lavfi", "-i", "color=c=gray:s=1080x1920:d=1", "-frames:v", "1", str(output)], capture_output=True)
paths.append(output)
time.sleep(1)
return paths
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
for c in chunks:
f.write(c)
probe = subprocess.run(["ffprobe", "-v", "quiet", "-print_format", "json", "-show_format", str(vf)], capture_output=True, text=True, encoding='utf-8', errors='ignore')
try:
dur = float(json.loads(probe.stdout)["format"]["duration"])
except:
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
with open(concat, "w", encoding="utf-8") as f:
for vf in all_files:
f.write(f"file '{str(vf.absolute()).replace(chr(92), '/')}'\n")
subprocess.run(["ffmpeg", "-y", "-f", "concat", "-safe", "0", "-i", str(concat), "-c", "copy", str(merged)], capture_output=True)
print(f" 总时长: {timestamps[-1]['end']:.2f}s")
return merged, timestamps
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
with open(concat, "w", encoding="utf-8") as f:
for vf in all_files:
f.write(f"file '{str(vf.absolute()).replace(chr(92), '/')}'\n")
subprocess.run(["ffmpeg", "-y", "-f", "concat", "-safe", "0", "-i", str(concat), "-c", "copy", str(merged)], capture_output=True)
print(f" 总时长: {timestamps[-1]['end']:.2f}s")
return merged, timestamps
The ffmpeg filter graph is constructed by interpolating user-controlled book title, author, and quote text into the -vf argument with only partial escaping. That can break filter parsing or inject unintended ffmpeg filter syntax, causing command misuse, malformed output, or processing of unintended resources inside ffmpeg.
else:
vf = f"scale=1188:2112,crop=1080:1920:50:192-t*60,{title_f},{cn_f},{en_f}"
subprocess.run(["ffmpeg", "-y", "-loop", "1", "-i", str(bg), "-t", str(dur), "-vf", vf, "-c:v", "libx264", "-pix_fmt", "yuv420p", "-r", "30", str(out)], capture_output=True)
if out.exists() and out.stat().st_size > 1000:
videos.append(out)
print(f" [{i+1}/{len(segments)}] {dur:.2f}s")
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
subprocess.run(["ffmpeg", "-y", "-f", "concat", "-safe", "0", "-i", str(concat), "-c", "copy", str(merged)], capture_output=True)
output = run_dir / "final.mp4"
subprocess.run(["ffmpeg", "-y", "-i", str(merged), "-i", str(voice_path), "-c:v", "copy", "-c:a", "aac", "-b:a", "192k", "-shortest", str(output)], capture_output=True)
return output
The description is presented only in Chinese ("书单爆款短视频生成器"), which imposes a specific language on users without any opt-in or indication that the skill is intentionally region-specific. This is a natural-language locale policy concern because the file provides no alternative language option or justification for the restriction.
Each entry includes a Chinese primary text field (cn) and the file presents the script as fixed bilingual content rather than offering language selection or opt-in. This can violate language/locale policy when a skill defaults to a specific language without giving the user a choice or stating that the skill is intentionally region-specific.
No suspicious patterns detected.