百度智能云VOD视频翻译

• Outcome: Review
• Latest audit: Jun 23, 2026 · 8:55 AM UTC
• Version: 1.0.3

Overview

This skill appears to do what it claims, but it has high-impact cloud project deletion and media upload capabilities that need closer review before use.

Install only if you are comfortable sending the selected videos, subtitles, and speech content to Baidu cloud services and paying for VOD processing. Use credentials with the least necessary Baidu permissions, avoid running deletion commands unless you have verified the exact project ID, and prefer testing with non-sensitive media first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

Tainted flow: 'upload_url' from os.environ.get (line 263, credential/environment) → requests.put (network output)

Critical

• Category: Data Flow

Content

headers = {"Content-Type": "video/mp4"}
    with open(video_path, 'rb') as f:
        response = requests.put(upload_url, data=f, headers=headers, timeout=600)
    
    if response.status_code in [200, 100]:
        if debug:

• Confidence: 82% confidence
• Finding: response = requests.put(upload_url, data=f, headers=headers, timeout=600)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares powerful tools (Bash, Read, Glob, Grep, Write) and instructs the agent to use environment variables, local file access, shell execution, and cloud/network-backed operations, but it does not clearly declare or constrain these sensitive capabilities as permissions. This creates a mismatch between apparent scope and actual authority, increasing the risk of unintended file access, credential use, or external data transfer.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The trigger rules and intent model expand the skill from video translation into project/task management, which is a broader administrative surface than the stated user-facing purpose. Broader scope increases the chance that the skill performs state-changing actions a user did not intend when they only asked for translation help.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The documented decision tree includes project deletion, which is a destructive administrative action not necessary for basic video translation. If triggered or mapped incorrectly, it could remove user resources or cloud-side state with potentially irreversible operational loss.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger conditions include broad natural-language phrases such as needing translation, dubbing, or task management, without strong boundaries. Overbroad triggers can cause accidental activation in unrelated conversations, leading the agent to solicit files, inspect folders, or prepare external processing when the user did not intend to invoke this skill.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill description emphasizes translation features and pricing, but does not clearly warn that video/subtitle content may be uploaded to Baidu cloud services and optionally to netdisk. This omission undermines informed consent for potentially sensitive media, subtitles, or speech data leaving the local environment.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This helper downloads remote content and writes it directly to a caller-specified output_path with no confirmation, path restrictions, or safety checks. In an agent context, untrusted inputs could overwrite arbitrary files accessible to the process or place attacker-controlled content in sensitive locations.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script deletes a translation project immediately when --delete-project is supplied, with no confirmation prompt, dry-run, or explicit force flag. In a CLI that can be invoked by an agent or with user-supplied parameters, this creates a real risk of accidental destructive actions and unintended loss of project/task state.

VirusTotal

61/61 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.