ai-video-gen

• Outcome: Pass
• Latest audit: May 28, 2026 · 12:23 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward AI video-generation helper that uses a disclosed external API key, downloads generated media, and runs FFmpeg, with no hidden persistence or destructive behavior found.

Install only if you are comfortable sending prompts, voiceover text, and generation inputs to SkillBoss/HeyBoss services and storing a local API key. Use a dedicated key, keep .env private, avoid confidential or regulated content unless approved, run it in a virtual environment, and review output paths because FFmpeg commands may overwrite chosen output files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tainted flow: 'audio_url' from requests.post (line 36, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

).json()

    audio_url = result["result"]["audio_url"]
    audio_data = requests.get(audio_url).content
    with open(output_path, 'wb') as f:
        f.write(audio_data)

• Confidence: 91% confidence
• Finding: The code trusts audio_url returned by an external API and immediately fetches it with requests.get, creating an SSRF-style trust boundary issue. If the upstream service is compromised or returns an unexpected URL, the script could be induced to contact arbitrary hosts and download untrusted content.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill documentation describes capabilities that require environment variable access, network access, file writing, and shell/FFmpeg execution, yet no permissions are declared. This creates a transparency and consent problem: users or hosting platforms may not realize the skill can exfiltrate prompts or media to external services and invoke local tooling, increasing the risk of unintended data exposure or unsafe execution.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README instructs users to configure an API key and send prompts, images, video, and voice content to external AI services, but it does not warn that this data will be transmitted off-host to a third party. This can lead users to unknowingly upload sensitive text or media, creating privacy, confidentiality, and compliance risks, especially in enterprise or regulated environments.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill sends user prompts, narration text, and potentially images or generated media to SkillBoss API Hub, but the description does not clearly warn users that their content leaves the local environment. In a media-generation workflow, prompts and uploaded assets may contain sensitive or proprietary information, so omission of this disclosure can lead to inadvertent third-party data exposure.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The provided voiceover text is transmitted to an external TTS service with no explicit disclosure or consent mechanism in the tool. In an end-to-end video-generation skill, prompts may contain sensitive or proprietary data, so undisclosed outbound transmission increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: User-supplied prompts and optional voiceover text are transmitted to a third-party API, but the CLI does not clearly warn users that their content leaves the local environment. In a content-generation skill, users may provide sensitive or proprietary text, so lack of disclosure creates a real privacy and data-handling risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pillow>=10.0.0
python-dotenv>=1.0.0

• Confidence: 98% confidence
• Finding: The dependency is specified with only a lower bound, which allows future unreviewed versions to be installed and makes builds non-reproducible. In a security-sensitive skill that relies on third-party HTTP libraries, this increases supply-chain risk and can unexpectedly pull in a vulnerable or behavior-changing release.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pillow>=10.0.0
python-dotenv>=1.0.0

• Confidence: 98% confidence
• Finding: The Pillow package is unpinned, so installations may resolve to different versions over time, including newly introduced vulnerable releases. Because this skill performs AI image/video generation, Pillow is likely part of the core processing path, which makes dependency drift more operationally and security sensitive.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pillow>=10.0.0
python-dotenv>=1.0.0

• Confidence: 95% confidence
• Finding: Using an unpinned python-dotenv version permits uncontrolled upgrades and non-reproducible environments. While lower impact than image or network libraries, it still contributes to supply-chain exposure and can introduce insecure behavior unexpectedly.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: The requirements file allows installation of requests versions that may include known vulnerabilities, and the finding indicates multiple advisories affecting that package family. Since this skill likely interacts with external APIs for AI/video generation, weaknesses in HTTP handling can expose credentials, bypass verification, or leak sensitive data in a realistic attack path.

Known Vulnerable Dependency: pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: Pillow is flagged with multiple serious advisories, including memory corruption and possible code execution classes of issues. In an AI video generation skill that likely processes untrusted or semi-trusted images, thumbnails, and frames, an exploitable Pillow flaw could be triggered through crafted media inputs, making the context especially dangerous.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 77% confidence
• Finding: The file permits installation of python-dotenv versions implicated by an advisory involving symlink-following during set_key operations. This is only exploitable if the skill actually invokes vulnerable write/update functionality on attacker-influenced paths, so the package-level risk is real but the practical exploitability from this file alone appears limited.

Static analysis

No suspicious patterns detected.