AI图转视频专家

• Outcome: Review
• Latest audit: Aug 14, 2026 · 3:45 PM UTC
• Version: 1.0.0

Overview

The skill is mainly an image-to-video integration, but it needs Review because bundled helpers also handle account login, API-key issuance, and payment-order workflows with sensitive credential and billing authority.

Install only if you intend to use LinkFox's external video service and are comfortable sending image URLs, prompts, task data, and generated media through that provider. Treat the onboarding and billing helpers as sensitive: do not provide phone numbers, SMS codes, API keys, plan choices, or payment actions unless you explicitly requested that flow, and avoid overriding LinkFox endpoint environment variables unless you fully trust the destination.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 96% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends login data, SMS verification requests, access tokens, refresh tokens, and group/token management traffic to those endpoints. If an attacker can influence environment variables, they can redirect sensitive authentication flows to an arbitrary host and capture credentials or API tokens, which is especially dangerous because this file explicitly handles account login and token issuance.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway URL is derived from environment variables and then used in urlopen with the Authorization header populated from the agent API key. An attacker who controls the environment can redirect gateway calls to an attacker-operated server and exfiltrate the API key and related account/order data.

Tainted flow: 'req' from os.environ.get (line 295, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req = _lf_Request(url, headers={"User-Agent": "LinkFox-Skill/2.0"})
    try:
        with _lf_urlopen(req, timeout=timeout) as resp:
            if guessed_ext == "bin":
                ct = resp.headers.get("Content-Type", "")
                if "mp4" in ct:

• Confidence: 95% confidence
• Finding: The downloader fetches arbitrary URLs from `resultList` and writes the responses to local storage without validating the destination host, IP range, or scheme beyond allowing HTTP/HTTPS. If the upstream service response is compromised or attacker-influenced, this creates an SSRF primitive that can reach internal services or download untrusted content into the agent workspace.

Tainted flow: 'url' from os.environ.get (line 235, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

except RuntimeError as e:
        return {"_error": str(e)}
    try:
        r = requests.post(url, json=body or {}, headers=headers, timeout=timeout)
        return r.json()
    except Exception as e:
        body_text = ""

• Confidence: 95% confidence
• Finding: The script builds request destinations from environment-controlled base URLs and then sends sensitive data such as phone numbers, SMS codes, access tokens, refresh tokens, and generated API tokens to those endpoints. If an attacker can influence environment variables, they can redirect authentication and token flows to an attacker-controlled server, causing credential exfiltration and account compromise.

Tainted flow: 'req' from os.environ.get (line 244, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

headers["Content-Type"] = "application/json"
        req = Request(url, method=method, data=body_bytes, headers=headers)
        try:
            with urlopen(req, timeout=30) as resp:
                return json.loads(resp.read().decode())
        except urllib.error.HTTPError as e:
            status = e.code

• Confidence: 95% confidence
• Finding: The gateway request path uses an environment-derived base URL and attaches the API key in the Authorization header before calling urlopen. A hostile environment value can redirect these authenticated requests to an attacker-controlled endpoint, leaking the API key and enabling unauthorized billing, order, and account operations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to use environment-backed API credentials, read and write task/result files under the workspace, and invoke network-capable downstream skills, but it declares no permissions. This creates a least-privilege and transparency gap: the runtime may grant broader capabilities than reviewers or users expect, making misuse of credentials, filesystem artifacts, or outbound requests harder to detect and govern.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The onboarding guide expands an image-to-video skill into account recovery, registration, API-key handling, and billing workflows that are outside the declared feature scope. This increases the skill's authority and data-handling surface, creating opportunities for unnecessary collection of phone numbers, payment interaction, and credential distribution if invoked in normal operation.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The document instructs operators to run registration, login, plan listing, order creation, and payment-related commands that are not necessary for generating a video from an image. Embedding these commands in the skill raises the risk that an agent will perform sensitive account and commerce actions under the guise of a media tool, which is especially dangerous because the commands can affect real user accounts and purchases.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements phone-based login, API key retrieval, plan listing, purchasing, and payment-status querying, which materially exceeds the declared image-to-video function of the skill. Scope divergence is dangerous because it introduces credential-handling and billing capabilities users would not reasonably expect from a media-generation skill, increasing the chance of unauthorized account or payment actions.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code can fetch or generate persistent API tokens for the user's group and then return them to the caller. In the context of an image-to-video skill, that capability is unjustified and significantly raises the blast radius because possession of the token can enable continued access beyond the immediate session.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script creates paid orders and produces payment QR codes, adding a commerce and billing surface unrelated to the advertised image-to-video scope. This mismatch is risky because users or calling agents may trigger purchases unexpectedly, and the skill gains the ability to initiate financial workflows that deserve stronger disclosure and isolation.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The reference file for an image-to-video skill documents a separate feedback-reporting API that is outside the stated core capability and instructs sending free-form content describing what the user said and what happened. This creates a data exfiltration/privacy risk because implementers may forward user interaction details to an unrelated external endpoint without clear necessity, consent, or minimization controls.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The documentation explicitly defines a capability to send user feedback content to a separate external endpoint unrelated to video generation, including narrative content about user statements and outcomes. In agent contexts, this can lead to unauthorized sharing of sensitive prompts, business data, or personal information under the guise of feedback submission.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill documentation directs the agent to handle account onboarding, login, API-key setup, and paid-plan purchasing, which materially exceeds the stated image-to-video generation scope. This expands the trust boundary into credential handling and payment facilitation, increasing the chance of unauthorized account actions, social-engineering abuse, or accidental collection of sensitive data.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: This skill is described as image-to-video generation, but the script performs account onboarding, SMS login, API-key issuance, plan discovery, and commerce actions. That mismatch expands the trust boundary and can trick users into providing credentials and purchasing access unrelated to the core media-generation function.

Context-Inappropriate Capability

High

• Confidence: 90% confidence
• Finding: The code includes plan listing, order creation, and payment QR generation, which are not necessary to convert images to video. In a creative-generation skill context, embedded purchase flows increase the risk of deceptive billing, accidental payments, and abuse if the skill is invoked by users expecting only content generation.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger description is overly broad and ambiguous, which can cause the skill to activate outside its intended scope. In an agent environment, misrouting user requests to a media-generation skill can lead to unintended external API calls, unnecessary spend/quota consumption, and accidental processing of user-provided images or prompts by the wrong tool.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The API reference instructs clients to send user-provided image URLs and prompt content to external services, and later describes a separate feedback submission API, but it does not mention consent, data handling, retention, or privacy implications. In a skill that processes potentially sensitive user media, this omission can lead to silent third-party transmission of personal data and unexpected disclosure beyond the user’s expectations.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The guide tells the operator to collect a user's phone number and use it for code sending and login without any privacy notice, data-minimization guidance, or verification of user consent. This creates a real risk of mishandling personal data and facilitating account takeover or unauthorized registration if the number or SMS code is collected from the wrong person or retained insecurely.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The login flow emits the obtained API key in stdout JSON, which may be captured by logs, shell history wrappers, orchestration systems, or downstream agents. Because the credential appears in ordinary command output, accidental disclosure is likely and could enable unauthorized use of the user's account or credits.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The order flow writes QR code PNG files into a session directory on disk without an in-file warning or explicit retention controls. While the QR itself is not as sensitive as an API token, it may represent an active payment artifact and can expose billing metadata or be misused by other local users on shared systems.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The trigger phrases are broad enough to match generic requests like '生成视频', '做个视频', or 'AI视频', which can cause this skill to activate when a user did not specifically intend to use this provider or workflow. In this skill’s context, unintended activation can lead to external API calls, long-running jobs, and automatic local persistence of generated media, increasing privacy, cost, and confusion risks.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill documents that generated videos are automatically downloaded into the session media directory and raw API responses are silently written to local data storage, but it does not clearly warn users up front before execution. In a media-generation workflow that may process user-supplied images and prompts, silent persistence creates privacy and data-retention risk, especially if users expect ephemeral processing.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The feedback API section describes transmitting user-related feedback content to an external service but provides no user-facing privacy warning, consent requirement, retention notice, or sensitivity guidance. This is dangerous because developers or agents may treat the endpoint as routine and disclose personal or confidential user data without transparency or authorization.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instructions tell the operator to collect a user's phone number and use it in a script-driven registration/login flow, but provide no privacy notice, retention guidance, or user-facing disclosure about transmitting personal data. This creates a real risk of improper PII collection and account takeover-sensitive handling without informed consent or minimal-data safeguards.

Static analysis

No suspicious patterns detected.