Back to skill

Security audit

AIGC视频生成

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a real LinkFox video-generation integration, but it also handles phone login, API-token creation, and payment ordering in ways users should review carefully before installing.

Install only if you are comfortable letting this skill use LinkFox network services for generation and, when auth or balance problems occur, assist with phone/SMS login, API-key setup, plan listing, and payment order creation. Prefer using LinkFox's self-service site for account and billing actions, avoid storing API keys permanently on shared machines, and review any payment QR or shell-profile command before using it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""
Confidence
94% confidence
Finding
r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code
Confidence
93% confidence
Finding
with urlopen(req, timeout=30) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill documentation indicates use of environment variables, network access, and file writes, but it declares no permissions. This creates a transparency and governance gap: users or hosting platforms cannot accurately assess what the skill can access or modify, and it may be granted execution in contexts that would otherwise require review. In this skill, the risk is amplified because it downloads remote content and writes files to local session directories.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill is presented as an image-to-video generator, but the referenced behavior includes account login, SMS verification, API key retrieval/generation, account/team info access, package listing, payment order creation, QR code payment generation, and payment-status queries. That is a significant scope expansion into authentication, credential handling, account data access, and financial operations, which can surprise users and bypass informed consent. In skill context, this mismatch is especially dangerous because billing and account actions are unrelated high-risk capabilities compared with simple media generation.

Description-Behavior Mismatch

High
Confidence
95% confidence
Finding
The onboarding document gives the skill authority to handle authentication recovery, account registration, and billing/payment flows that are outside the narrow scope of video generation. This expands the skill into identity, credential, and payment handling, increasing the chance of phishing-like behavior, unauthorized account actions, and unsafe collection of sensitive user data.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The file instructs operators to run registration/login and plan-purchase commands on behalf of users, which is not justified by the advertised purpose of a video-generation skill. A skill that can trigger account creation, login, and commerce workflows creates a broader attack surface for social engineering, unauthorized transactions, and misuse of user identity data.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This file implements onboarding, SMS login, API key acquisition, package listing, order creation, and payment QR generation, which is materially unrelated to a video-generation skill's stated function. In the skill context, this expands the privilege and data-handling surface to account access and billing workflows that users would not reasonably expect when invoking video generation.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The code provisions API tokens and performs billing/payment actions, including order creation and QR rendering, despite the skill being described as a media-generation tool. In-context, this is especially risky because it enables acquisition of long-lived credentials and monetization flows that could be abused or used for undisclosed account operations.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The trigger phrases include broad everyday terms such as '做个视频', '生成视频', and 'AI视频', increasing the chance of accidental invocation in unrelated conversations. Over-broad triggering can cause unintended network requests, media processing, file writes, or exposure of user-supplied image URLs to external services without deliberate user intent. The impact is lower than credential or payment issues, but it still increases the attack surface and likelihood of unintended execution.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation describes transmitting user-provided image URLs, prompts, optional last-frame URLs, and feedback content to external services without any privacy notice, consent guidance, or data-handling warning. In a media-generation skill, these inputs may contain sensitive images, private URLs, or personal text, so silent forwarding to third-party endpoints creates meaningful privacy and compliance risk.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The documentation tells the operator to collect a user's phone number and use it to send verification codes and log in, but provides no privacy notice, consent language, retention policy, or secure handling requirements. This creates risk of unnecessary collection of personal data and account takeover if phone-based authentication is initiated without strong verification and transparency.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs operators to give users shell commands that permanently write API keys into shell startup files, without warning about secret exposure, shared machines, command history, or safer alternatives. Persisting credentials this way can leak secrets or leave long-lived tokens on systems where other users or processes may access them.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The CLI emits the obtained API key directly to stdout JSON, which can be captured by logs, wrappers, shell history tooling, or other components in the agent pipeline. In a hosted skill environment, stdout is often observable beyond the immediate user, so this creates an unnecessary secret disclosure channel.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.