Security audit

short-video-ecommerce

Security checks for vulnerabilities and agentic risk

Overview

This package is not clearly malicious, but its visible instructions promise a YouTube Shorts generator while its manifest and code implement e-commerce dropshipping and listing workflows.

Review before installing. Treat this as an e-commerce/dropshipping automation package, not just a YouTube Shorts creator. Do not provide marketplace credentials or sensitive API keys unless you intentionally want commerce listing workflows, and expect local output files plus possible third-party AI or media-service use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill advertises capabilities that imply access to environment variables, filesystem read/write, and network resources, but it declares no permissions at all. That creates a transparency and consent problem: users and the platform cannot accurately assess what the skill may access, increasing the chance of unintended data exposure or unsafe execution in a broader privilege context.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: A major description-behavior mismatch is a strong security red flag because it can conceal functionality users did not consent to, such as ecommerce research, downloading external assets, compliance screening, and possible listing/publishing workflows unrelated to YouTube Shorts. Hidden or misleading scope is dangerous because it can be used to exfiltrate data, perform unauthorized network actions, or manipulate business workflows under the cover of a benign media-creation tool.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill metadata advertises an automated YouTube Shorts creation workflow, but the code actually implements a short-video e-commerce product-selection and listing pipeline. This mismatch can mislead users and platform operators about the skill’s real capabilities and trust boundary, increasing the risk of unauthorized commerce automation, deceptive deployment, or bypass of review processes that would have applied to an e-commerce skill.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The code and comments claim 'one-click' publishing/listing, but the implementation only writes manual instructions and returns auto_publish=False. This is a trust and transparency issue: users may believe the skill has completed or is capable of automated platform actions when it has not, which can cause unsafe operational assumptions and conceal the actual level of human review involved.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest identifies the skill as a broad short-video e-commerce automation workflow, which materially diverges from the stated YouTube Shorts automation context. This kind of scope mismatch can mislead users and downstream policy checks, causing them to grant access to commerce, publishing, or research capabilities that are not expected for the advertised use case.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The declared dependencies include market research, e-commerce APIs, and platform-specific publishing integrations that are unnecessary for a YouTube Shorts creation tool. Unjustified capability expansion increases the attack surface and enables unauthorized product research, marketplace actions, or cross-platform publishing beyond user expectations.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This module performs e-commerce product publishing even though the skill is described as YouTube Shorts automation. That scope mismatch is dangerous because it introduces unrelated commerce capabilities that could be used to list products on external marketplaces without clear user expectation, consent boundaries, or platform-specific safeguards. In this context, hidden or undocumented commercial actions are more suspicious because they materially expand what the agent can do beyond video creation.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The code checks for marketplace API credentials for several commerce platforms unrelated to the stated skill purpose. Even though it only tests for presence, accessing unrelated secrets expands the trust boundary and indicates the skill may probe the runtime for sensitive credentials it should not need. In a YouTube automation skill, this behavior is more concerning because the credentials are out of scope and could enable unexpected external actions if later wired up.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file implements product-market and dropshipping research logic, which materially diverges from the declared YouTube Shorts automation purpose. This kind of capability mismatch is dangerous because users or downstream agents may grant permissions and trust based on the manifest, while the skill actually supports unrelated commerce reconnaissance and data collection workflows.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: The README advertises a one-click workflow that produces ready-to-upload media artifacts, but it does not clearly warn users that the skill will generate and write multiple files such as MP4s, thumbnails, and metadata outputs. This is a real transparency and safety issue because users may invoke the command without understanding that filesystem changes and potentially large artifact creation will occur automatically.

Missing User Warnings

Low

Confidence: 72% confidence
Finding: The skill description emphasizes one-click automation and output generation but does not warn users about automatic file creation, possible overwrites, external content generation, or workflow side effects. While less severe than hidden functionality, this omission can still cause accidental data loss, unexpected resource usage, or unsafe publication of autogenerated content without adequate review.

Static analysis

No suspicious patterns detected.