百度智能云VOD字幕擦除

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:48 AM UTC
• Version: 1.0.3

Overview

This skill is a Baidu Cloud video subtitle-removal workflow that uses cloud uploads and credentials as part of its stated purpose, with no artifact-backed evidence of hidden exfiltration or persistence.

Install only if you intend to send selected videos to Baidu Cloud VOD and are comfortable using Baidu VOD AK/SK credentials and any existing bdpan session. Review task deletion requests carefully, keep originals separate from outputs, and avoid processing private or sensitive videos unless Baidu's service terms and retention practices are acceptable to you.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (20)

Tainted flow: 'json_data' from os.environ.get (line 306, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

if method == "GET":
        response = requests.get(url, headers=headers, params=params, timeout=30)
    elif method == "POST":
        response = requests.post(url, headers=headers, json=json_data, timeout=30)
    elif method == "PUT":
        response = requests.put(url, headers=headers, json=json_data, timeout=30)
    else:

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'json_data' from os.environ.get (line 306, credential/environment) → requests.put (network output)

Critical

• Category: Data Flow

Content

elif method == "POST":
        response = requests.post(url, headers=headers, json=json_data, timeout=30)
    elif method == "PUT":
        response = requests.put(url, headers=headers, json=json_data, timeout=30)
    else:
        raise ValueError(f"不支持的 HTTP 方法: {method}")

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'upload_url' from os.environ.get (line 262, credential/environment) → requests.put (network output)

Critical

• Category: Data Flow

Content

headers = {"Content-Type": "video/mp4"}
    with open(video_path, 'rb') as f:
        response = requests.put(upload_url, data=f, headers=headers, timeout=600)

    if response.status_code in [200, 100]:
        if debug:

• Confidence: 90% confidence
• Finding: The code uploads the full contents of a local video file to whatever upload_url is returned by the API flow, with no validation that the destination host is an expected Baidu-controlled endpoint. If the upstream response is compromised or misdirected, this can exfiltrate arbitrary local media selected by the user to an attacker-controlled server.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: This skill performs multiple outbound network operations, including authenticated API requests, file upload, and result download, yet the finding indicates network capability is undeclared. In a permissioned agent platform, hidden network access materially increases risk because the skill can transmit user files and metadata off-platform without transparent authorization boundaries.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: This skill performs multiple outbound network operations, including authenticated API requests, file upload, and result download, yet the finding indicates network capability is undeclared. In a permissioned agent platform, hidden network access materially increases risk because the skill can transmit user files and metadata off-platform without transparent authorization boundaries.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill description emphasizes local/netdisk selection and cloud-backed processing, but it does not prominently disclose that videos may be uploaded, transferred, or exposed to third-party cloud services. For potentially sensitive video content, this omission creates privacy and data-handling risk because users may not realize their files leave the local environment.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The documentation does not clearly warn that the operation modifies video content and may affect many files in batch mode. Without prominent warnings about destructive or irreversible edits, users may confirm actions without understanding the scope of changes to local media.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a subtitle-erasure tool, but the documentation broadens its behavior to include logo/watermark removal and remote task query/delete operations. This creates capability drift: users or downstream agents may invoke actions outside the declared purpose, increasing the chance of unintended destructive media edits or remote state changes.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger rules include broad natural-language conditions such as handling users who 'need to process subtitles' or 'query/delete tasks,' which can cause accidental invocation outside the intended scenario. Over-broad activation is risky for a skill that can modify media and potentially perform remote operations, because it lowers the threshold for unintended execution paths.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: Documenting task deletion in a subtitle-removal skill introduces a destructive remote operation that is not justified by the core use case. If triggered or followed by an agent, it could delete cloud processing tasks unexpectedly, causing loss of work or disruption of user workflows.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Adding logo/watermark removal extends the skill beyond subtitle erasure into generalized region-based content removal. That broader editing capability is more easily misused, and it changes the trust assumptions for a skill that users would reasonably expect to only target subtitles.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The module documentation and user-facing messages are written exclusively in Chinese, and status checks also depend on the Chinese phrase "已登录". This imposes a language/locale requirement without offering a user choice or documenting a justified region-specific constraint.

External Transmission

Medium

• Category: Data Exfiltration

Content

if method == "GET":
        response = requests.get(url, headers=headers, params=params, timeout=30)
    elif method == "POST":
        response = requests.post(url, headers=headers, json=json_data, timeout=30)
    elif method == "PUT":
        response = requests.put(url, headers=headers, json=json_data, timeout=30)
    else:

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

elif method == "POST":
        response = requests.post(url, headers=headers, json=json_data, timeout=30)
    elif method == "PUT":
        response = requests.put(url, headers=headers, json=json_data, timeout=30)
    else:
        raise ValueError(f"不支持的 HTTP 方法: {method}")

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def check_bdpan_installed():
    """检查 bdpan 是否安装"""
    try:
        result = subprocess.run(
            ["bdpan", "version"],
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def check_bdpan_logged_in():
    """检查 bdpan 是否已登录"""
    try:
        result = subprocess.run(
            ["bdpan", "whoami"],
            capture_output=True,
            text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if debug:
        print(f"执行: {' '.join(cmd)}")
    
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
    
    if result.returncode == 0:
        if debug:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if debug:
        print(f"执行: {' '.join(cmd)}")
    
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
    
    if result.returncode == 0:
        if debug:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def list_netdisk_files(path="", debug=False):
    """列出网盘文件"""
    cmd = ["bdpan", "ls", path, "--json"]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
    
    if result.returncode == 0:
        try:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The function downloads remote content and writes it directly to a caller-supplied local path. Although the docstring says it downloads results, there is no confirmation prompt or explicit user-facing warning that this operation will create or overwrite a local file.

Static analysis

No suspicious patterns detected.