Ai Video Generation

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:13 AM UTC
• Version: 1.0.0

Overview

This is a coherent AI video-generation helper, but it installs a mutable third-party npm CLI and stores or uses a paid-service API key, so it should be reviewed before use.

Install this only if you intend to use the ricebowl.ai ai-media CLI workflow. Review or pin the ai-media-generator npm package before installing, use a scoped API key where possible, avoid exposing unrelated environment variables or files to the CLI process, and confirm where ai-media stores the configured key so you can rotate or remove it later.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party Executable npm Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–20
Vulnerability Type: Unpinned executable dependency and supply-chain exposure
Risk Level: Medium

yaml

install:
  - kind: node
    package: ai-media-generator
    bins: [ai-media]

Technical Analysis

The skill instructs the runtime to install the third-party ai-media-generator npm package without specifying an exact version or integrity hash. The installed package supplies the executable ai-media command used throughout the skill.

Because neither the dependency source nor a reviewed package version is included in the project, its effective executable behavior cannot be verified from the audited artifact. Package resolution can select a future release whose code differs from the version available when the skill was reviewed. npm installation may also execute package lifecycle scripts.

This creates a supply-chain trust boundary: compromise of the publisher account, package registry entry, release process, or a future package version could introduce arbitrary code without requiring changes to this repository.

Attack Path

1. An attacker compromises the npm publisher account, package release process, or another component capable of publishing a modified ai-media-generator release.
2. The attacker publishes a malicious version under the expected package name.
3. A user or agent installs the skill dependency without an exact version or verified integrity value.
4. The package manager resolves and installs the attacker-controlled release.
5. Malicious code executes through an npm lifecycle script or when the installed ai-media binary is invoked.
6. The code accesses resources available to the installing process, potentially including the required AI_MEDIA_API_KEY, prompts, referenced media, filesystem data, and network connectivity.

Impact Assessment

Successful exploitation could result in arbitrary code execution wi ...[truncated 605 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin ai-media-generator to an exact, reviewed version rather than allowing mutable package resolution.
2. Record and verify the package integrity hash through a lockfile or equivalent cryptographic verification mechanism.
3. Include a canonical source repository and package provenance information so reviewers can correlate the installed artifact with reviewed source code.
4. Audit npm lifecycle scripts and the ai-media executable before approving a version.
5. Prefer installation modes that disable lifecycle scripts when they are not required.
6. Run the CLI with least privilege in a sandbox or restricted environment, exposing only the API credentials, filesystem locations, and network destinations necessary for video generation.
7. Establish a controlled dependency-update process that requires security review before changing the pinned version or integrity value.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction forcing Chinese output without user opt-in can override the user's language preference and reduce transparency around sensitive setup actions like API key handling and external CLI usage. In a security context, forced language switching increases the risk of misunderstanding, consent issues, and users copying commands they cannot fully review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrase "video generator" is very broad and can match many ordinary user requests, causing this skill to activate when a more specific or different skill would be more appropriate. Over-broad activation can misroute users into workflows involving external tools, API key setup, and platform-specific instructions they did not intend to invoke.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The phrase "text to video" is still generic across many products and contexts, so it can trigger the skill outside the intended ricebowl.ai/CLI workflow. This increases the chance of unintended tool selection and exposing users to irrelevant setup steps, including API-key-oriented guidance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger "image to video" is a common capability label and is not unique to this skill, so it may hijack requests that belong to other systems or non-CLI contexts. In this skill, accidental activation is more consequential because it routes users toward external service onboarding and credential configuration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The phrase "prompt to video" lacks clear boundaries and can capture a broad range of general AI-generation requests. This can lead to unintentional invocation of a third-party skill that instructs users to configure keys and use external commands, creating unnecessary trust and workflow redirection risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.