Security audit

自动视频工具工作流

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent and not malicious, but it automates public Bilibili posting and recurring browser work without clear confirmation, scoping, or rollback controls.

Install only if you want an agent to operate a logged-in Huasheng/Bilibili browser workflow. Use a dedicated browser profile or account, review generated copy and cover text manually, and require explicit confirmation before any Bilibili submission or cron scheduling. Be aware it writes local files under the skill directory for news deduplication/output and fetches news from external sources with TLS verification disabled in the fetch script.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill describes network access for fetching news and local file/database writes for SQLite deduplication and media handling, but it does not declare corresponding permissions. Undeclared capabilities reduce transparency and can cause the agent to perform data retrieval or local state changes the user did not explicitly authorize, which is risky in an automation workflow that touches external sites and local files.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill claims to support a full automated publishing pipeline, but the described implementation does not actually include several high-risk actions it advertises while also omitting mention of local SQLite persistence. This mismatch is dangerous because users and calling systems may trust the skill with publication and browser automation expectations without understanding what is really implemented, leading to unsafe delegation, hidden persistence, and unreliable control boundaries.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger conditions are broad enough that the skill could activate for generic requests about news videos or publishing workflows without clear user confirmation. In a skill that can fetch content, manipulate browser state, and potentially publish to a platform, ambiguous activation increases the chance of unintended automation and accidental external actions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill is designed around automated content publication to Bilibili but does not prominently warn users that it may perform or guide account-level submission actions. In this context, missing warnings are significant because publishing is an irreversible external side effect that can affect account reputation, compliance, and accidental posting of unwanted content.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.insecure_tls_verification

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/fetch_news.py:20