AI video auto generator

• Outcome: Review
• Latest audit: Jul 16, 2026 · 8:42 PM UTC
• Version: 2.7.1

Overview

The skill appears to be a real AI video pipeline, but it needs review because it can install packages, run detached jobs, use global credentials, and upload or write data to third-party services with some scoping and documentation mismatches.

Install only if you are comfortable with an automated pipeline that can run commands, install dependencies, start background jobs, and send assets or metadata to external services. Prefer explicit local mode with --tracker local, use dedicated low-scope tokens, review config before running auto/setup, and avoid background mode unless you can monitor and stop the process.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (80)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 避免 JSON 内嵌双引号导致 cmd shell 解析错误
                full_args = [_LARK_EXE] + args
                cmd_line = subprocess.list2cmdline(full_args)
                r = subprocess.run(cmd_line, capture_output=True, text=True,
                                   encoding="utf-8", errors="replace",
                                   timeout=timeout, shell=True, env=_lark_env())
            else:

• Confidence: 95% confidence
• Finding: On Windows, the code constructs a command line and executes it with shell=True using arguments that may contain externally influenced values such as tokens, table IDs, record IDs, and JSON field content. Even though list2cmdline improves quoting, invoking cmd.exe expands the attack surface and can permit command-line interpretation quirks or shell metacharacter abuse through tool parameters.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

npm_cmd = shutil.which("npm") or "npm"

    try:
        r = subprocess.run(
            [npm_cmd, "install", "hyperframes"],
            cwd=workspace, capture_output=True, text=True, timeout=120,
        )

• Confidence: 93% confidence
• Finding: This code automatically invokes npm to install an external package at runtime, which introduces package-management and network execution behavior into a stitching module. If the npm registry response, dependency tree, or resolved npm binary is compromised, the process may execute attacker-controlled install scripts with the privileges of the current user.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        print(f"[HF] node: {' '.join(cmd)}")
        start = time.time()
        result = subprocess.run(
            cmd, cwd=project, env=env,
            capture_output=True, text=True,
            encoding="utf-8", errors="replace",

• Confidence: 85% confidence
• Finding: The subprocess call itself is not shell-injection prone because it passes an argument list, but it executes a locally resolved Node CLI over attacker-influenced project content and with inherited environment variables. In this skill context, rendering generated HTML/JS can trigger execution of remote or untrusted resources in the rendering stack, so the process-launch is part of a real attack surface.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

f'$p=[System.Diagnostics.Process]::Start($psi);'
        f'Write-Host "PID=$($p.Id)"'
    )
    result = subprocess.run(
        ["powershell.exe", "-NoProfile", "-Command", ps_cmd],
        capture_output=True, timeout=15,
        encoding="gbk", errors="replace",

• Confidence: 93% confidence
• Finding: The subprocess invocation itself is not the main issue, but here it executes a PowerShell command string that embeds untrusted values such as project path and arbitrary args into a nested cmd.exe /c command. Because the arguments are joined without robust escaping, an attacker controlling args or path content can trigger command injection in PowerShell/cmd and launch arbitrary commands.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

else:
        rel = os.path.basename(abs_path)
    
    r = subprocess.run(
        [LARK_EXE, "docs", "+media-insert", "--doc", docx_token,
         "--file", rel, "--type", "file", "--as", "user"],
        capture_output=True, text=True, encoding="utf-8", errors="replace",

• Confidence: 91% confidence
• Finding: This subprocess call invokes an external Feishu/Lark CLI to upload generated video content to a remote document service. Even though it uses a safe argv list, it still creates an exfiltration channel for local files and relies on unvalidated docx_token and relative path inputs, which is risky in an automated pipeline.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
            name = pip_name or mod
            print(f"  ⚠️  {mod} 未安装，自动安装 {name}...")
            r = subprocess.run(
                [py, "-m", "pip", "install", name, "-q"],
                capture_output=True, text=True, timeout=120)
            if r.returncode == 0:

• Confidence: 93% confidence
• Finding: The setup routine automatically installs Python packages at runtime, granting the skill package-management capability and allowing arbitrary code from package installation hooks or compromised dependencies to execute in the user's environment. In a skill context, silently modifying the environment and fetching code from external registries materially expands the trust boundary beyond simple video generation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"  ✅ ffmpeg: 已安装 (imageio-ffmpeg bundled)")
        except ImportError:
            print("  ⚠️  ffmpeg 未找到，自动安装 imageio-ffmpeg...")
            r = subprocess.run([py, "-m", "pip", "install", "imageio-ffmpeg", "-q"],
                               capture_output=True, text=True, timeout=120)
            if r.returncode == 0:
                print("  ✅ imageio-ffmpeg 安装成功")

• Confidence: 92% confidence
• Finding: This code automatically installs imageio-ffmpeg when ffmpeg is missing, which again pulls and executes third-party package code at runtime. That behavior is more dangerous than a normal media pipeline step because it introduces remote code execution through dependency installation rather than only consuming local tools.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises and instructs the agent to read files and URLs, write project artifacts such as script.json, invoke shell commands, access environment/API-key setup, and run a fully automated pipeline, but it declares no permissions. This creates a transparency and consent gap: users and hosting platforms cannot accurately scope or gate the skill’s access before it performs potentially sensitive file, network, and command execution actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior goes well beyond simple video generation: it includes ingesting local and remote documents, integrating with external services, uploading assets to third-party hosts, downloading audio, and even mentioning module extraction/reconstruction tooling. This mismatch undermines informed consent and increases the chance that users trigger data exfiltration, third-party sharing, or risky utility behavior they did not expect from the description.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: This work-memory entry documents the presence, migration, storage locations, and handling of real secrets including Agnes, GitHub PAT, FreeSound, and Feishu tokens. Even though it describes moving them out of config.toml, retaining operational details about live credentials in a broadly accessible memory/log file materially increases exposure risk and can aid secret discovery, reuse, or targeting of external services.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The memory file explicitly permits fallback to a shared credential source (`~/.agnes-api-key`) outside the skill and project boundary. That weakens isolation between projects/platform copies and can cause accidental cross-project credential reuse or unintended access if one workspace is compromised. In this skill context, which is designed to run unattended across multiple platforms, shared fallback credentials are more dangerous because they make lateral access and silent secret coupling easier.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The documented precedence says project-specific configuration should override skill-level defaults, but the implementation loads project config first and then skill config, so skill settings overwrite project settings. In a fully automated pipeline, this can silently force use of unintended API endpoints, credentials, safety settings, or output destinations, causing cross-project misconfiguration and possible data leakage between projects.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is presented as a 'pure generation' component, but the documentation describes GitHub-backed image hosting using a personal access token and repository operations. That expands the trust boundary from local generation to credentialed third-party storage, increasing the risk of unreviewed data exfiltration, accidental publication of user assets, and misuse of repository credentials.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The documented use of a GitHub PAT for repository access is not tightly aligned with the stated purpose of image/video generation and introduces a high-value secret into the workflow. If mishandled, the token could enable unauthorized repository reads or writes, and uploaded media may expose sensitive prompts, reference images, or project data to a third-party platform.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The module claims configuration should come only from project/config and skill/config, but these helpers also retrieve secrets from legacy home-directory files and environment variables. In an agent skill context, that broadens the trust boundary and can cause the skill to silently consume host-level credentials that the user did not intend to expose to this project.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The top-level docstring states that configuration only comes from project/config and skill/config, but the code later loads secrets from ~/.files and environment variables. This mismatch is dangerous because users and reviewers may rely on the documentation to assess isolation, while the actual behavior reaches into broader host secrets and can enable unintended credential use.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The extractor imports target modules directly with importlib.import_module(), which executes all module top-level code. If the .pyc or module path is attacker-controlled, simply analyzing it can trigger arbitrary code execution, defeating the premise of safe passive extraction.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file performs bytecode extraction and source reconstruction, which is materially unrelated to the declared AI video generation purpose of the skill. Capability mismatch is a supply-chain risk because hidden reverse-engineering or recovery tooling can facilitate unauthorized code inspection, concealment of provenance, or post-compromise persistence work inside an otherwise unrelated package.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The module silently expands its capabilities from local video stitching to package installation over the network. That creates supply-chain risk, can execute dependency lifecycle scripts, and materially increases what the skill can do on a user's machine beyond the expected task.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The generated HTML loads GSAP from a public CDN at render time, creating unnecessary outbound network access and introducing third-party script execution into a local rendering workflow. If the CDN resource is unavailable, tampered with, or intercepted in a hostile environment, the renderer may execute untrusted JavaScript.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This module is explicitly designed to start a hidden, detached process that survives the parent tool and avoids being killed by the parent job object. That persistence-like behavior reduces user visibility and control, making abuse harder to detect and allowing long-running or unwanted activity to continue after the initiating session ends.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The function interpolates `shot.get("description", "")` directly into an HTML document without escaping, placing attacker-controlled content inside a `<p>` element. If `shot` data can be influenced by a user or upstream AI-generated content, this enables stored/self-XSS when the generated diff page is opened in a browser, allowing script execution in the local file context.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The module is named and framed as a verification component, but `fix_script_narrative` mutates input content, renumbers shots, rewrites descriptions, injects hooks/transitions, and auto-adds new `character_cards` entries derived from free-form text. In an automated video pipeline, this blurs the trust boundary between validation and content generation, so a caller expecting a read-only safety/quality check may unknowingly persist attacker-controlled or hallucinated metadata and altered prompts downstream.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Accepting arbitrary HTTP(S) URLs gives the skill a broad network-fetch capability that exceeds simple local script generation and can be abused for unexpected outbound requests, internal endpoint probing, or ingestion of untrusted remote content. In an automation pipeline, this is more dangerous because a caller may pass attacker-controlled URLs and the fetched content is then trusted as script input with little restriction.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The module contains optional functionality to upload the generated video to Feishu/Lark, which extends beyond local video generation into external data transfer. In a fully automated skill, this materially increases privacy and data-leak risk because generated outputs may include sensitive content and the upload behavior is easy to overlook.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.