Sora Video

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:54 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent Sora video CLI, but its setup instructions ask users to run an unverified remote installer directly in a shell and use an unpinned runtime dependency.

Install only if you are comfortable reviewing or replacing the setup path. Prefer installing `uv` through a trusted package manager or verified release, use a pinned OpenAI SDK in an isolated environment, set `OPENAI_API_KEY` only when running the CLI, and double-check video IDs before using `delete` or `--force`.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:32

Finding

Unverified Remote Installer Piped Directly into a Shell

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:32-35
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code:

bash

### Python + uv
The CLI requires Python 3.10+ and uses `uv` for dependency management (auto-installs the `openai` SDK):
```bash
# Install uv if not present
curl -LsSf https://astral.sh/uv/install.sh | sh

text

### Technical Analysis

The installation instructions download a mutable script from an external server and immediately pipe its contents to `sh`. The retrieved code is not pinned to a specific version and is not checked against a cryptographic checksum or signature before execution.

HTTPS protects the connection in ordinary circumstances, but it does not establish that the returned script is the same payload that was reviewed with this project. A compromise of the hosting infrastructure, distribution account, DNS/TLS trust path, or remote installer can change the effective code executed by users without modifying this repository.

Installing `uv` supports the documented workflow, but direct remote-to-shell execution is not required for the Skill's video-generation functionality. Safer package-manager or verified-artifact installation methods can provide the dependency without granting an unreviewed response immediate code-execution privileges.

### Attack Path

1. An attacker compromises the remote installer source or another relevant part of its delivery infrastructure.
2. The attacker modifies the response served from `https://astral.sh/uv/install.sh`.
3. A user or Agent follows the prerequisite instructions and runs the documented command.
4. `curl` retrieves the modified response and passes it directly to `sh`.
5. The shell executes the attacker's commands with the privileges and environment of the invoking user.
6. The payload can inspect accessible files and environment variables, including `OPENAI_API_KEY` if it has alrea
...[truncated 852 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sh installation instruction.
2. Prefer an operating-system package manager or another trusted installation channel that performs package integrity validation.
3. If direct artifact installation is unavoidable:
   • Pin an exact uv release.
   • Download the artifact to a local file rather than piping it into a shell.
   • Obtain the expected checksum or signature through an authenticated release channel.
   • Verify the artifact cryptographically before execution.
   • Abort installation if verification fails.
4. Run installation in an isolated, unprivileged environment without sensitive environment variables.
5. Do not export OPENAI_API_KEY until installation is complete and the installed tooling has been verified.
6. Document the expected installer version, checksum, source, and update process so changes can be reviewed before deployment.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:88

Finding

Unpinned OpenAI SDK Is Dynamically Resolved at Runtime

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:88-94
Vulnerability Type: Insecure dependency management
Risk Level: Medium

Vulnerable Code:

bash

### Generate a video
```bash
uv run --with openai python "$SORA_CLI" create \
  --prompt "Close-up of a premium smartwatch on marble surface" \
  --model sora-2 \
  --size 1280x720 \
  --seconds 8

text

Equivalent unpinned `uv run --with openai` instructions are repeated throughout `SKILL.md` and `references/cli.md`. The script also recommends the same installation pattern when the SDK is unavailable:

```python
def _create_client():
    try:
        from openai import OpenAI
    except ImportError:
        _die("openai SDK not installed. Run with `uv run --with openai` or install with `uv pip install openai`.")
    return OpenAI()

Technical Analysis

The runtime dependency is specified only by the package name openai. The project contains no exact dependency version, lockfile, hash constraints, or package integrity policy. Consequently, the dependency resolver can install a different release over time even though the audited Skill files remain unchanged.

This creates supply-chain and reproducibility exposure. A compromised future package release, compromised package index, or maliciously altered configured index could cause attacker-controlled Python package code to execute when the command starts. It can also introduce unexpected API or security behavior through ordinary incompatible upstream changes.

Use of the official package name reduces the likelihood of classic typosquatting, but it does not protect against upstream release compromise, account compromise, index substitution, or unreviewed dependency updates.

Attack Path

1. An attacker compromises an upstream release account, package index, configured mirror, or a newly published dependency release.
2. A malicious or altered version is made available under ...[truncated 1416 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the OpenAI SDK to a reviewed exact version rather than using an unconstrained openai requirement.
2. Commit a dependency lockfile that includes resolved transitive dependencies and integrity hashes.
3. Use commands that enforce the lockfile and reject undeclared dependency changes.
4. Configure an explicitly trusted package index and prevent fallback to untrusted indexes or mirrors.
5. Install dependencies in an isolated virtual environment with only the filesystem and network permissions required by the CLI.
6. Review and test dependency updates before changing the lockfile.
7. Add automated dependency vulnerability and provenance checks to the release process.
8. Keep sensitive credentials out of the environment during dependency installation; expose OPENAI_API_KEY only when running the verified application.
9. Update all examples in SKILL.md, references/cli.md, and the import-error messages in scripts/sora.py to use the pinned, locked installation workflow.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The specific use of | sh chains network retrieval directly into command execution, which is a classic arbitrary code execution risk. In this skill context, users are being guided to prepare a local environment with API credentials, so executing an unverified installer could also expose sensitive environment data or modify the system before the actual CLI is used.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

The CLI requires Python 3.10+ and uses uv for dependency management (auto-installs the openai SDK):

bash

# Install uv if not present
curl -LsSf https://astral.sh/uv/install.sh | sh

Pricing Guide

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/video-api.md (reported line 64)May include surrounding context.

md

- `GET /videos/{id}`: retrieve status/details
- `GET /videos/{id}/content`: download content
- `GET /videos`: list
- `DELETE /videos/{id}`: delete
- `POST /videos/{id}/remix`: legacy/deprecated

## Download variants

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/sora.py (reported line 77)May include surrounding context.

python

_die(f"Prompt file not found: {path}")
        return path.read_text(encoding="utf-8").strip()
    if prompt:
        return prompt.strip()
    _die("Missing prompt. Use --prompt or --prompt-file.")
    return ""  # unreachable

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/sora.py (reported line 481)May include surrounding context.

python

_die(f"Prompt file not found: {path}")
        return path.read_text(encoding="utf-8").strip()
    if prompt:
        return prompt.strip()
    _die("Missing prompt. Use --prompt or --prompt-file.")
    return ""  # unreachable

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill explicitly instructs users to run a Python CLI that uses environment variables, downloads dependencies, performs network calls to the OpenAI API, and writes output files, yet it declares no permissions or allowed-tools metadata. This creates a transparency and policy gap: downstream systems or users cannot reliably constrain what the skill is allowed to access, increasing the chance of over-broad execution in an agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file documents a delete operation for video jobs but provides no warning that the action is destructive or may be irreversible. Under the markdown-specific missing-warning rule, user-facing documentation should disclose behaviors that can affect user data or resource integrity.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The skill recommends installing uv via a one-line remote script fetch and execution pattern. Piping a downloaded script directly into a shell bypasses integrity verification and review, so a compromised upstream host, MITM, or malicious script update could execute arbitrary code on the user's system.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

The CLI requires Python 3.10+ and uses uv for dependency management (auto-installs the openai SDK):

bash

# Install uv if not present
curl -LsSf https://astral.sh/uv/install.sh | sh

Pricing Guide

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The documentation states that all commands can write API responses to a file via --json-out, but it does not warn that saved responses may contain prompts, job metadata, or other user data. For markdown skill descriptions, behaviors affecting user data or privacy should be disclosed.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/sora.py (reported line 429)May include surrounding context.

python

def _extract_retry_after_seconds(exc: Exception) -> Optional[float]:
    for attr in ("retry_after", "retry_after_seconds"):
        val = getattr(exc, attr, None)
        if isinstance(val, (int, float)) and val >= 0:
            return float(val)
    msg = str(exc)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/sora.py (reported line 535)May include surrounding context.

python

return data[key]
        return None
    for key in ("status", "state"):
        val = getattr(video, key, None)
        if isinstance(val, str):
            return val
    return None