Security audit

Video Pipeline

Security checks for vulnerabilities and agentic risk

Overview

This video-generation skill mostly matches its stated purpose, but it sends content to external AI services, reads API credentials, includes a hard-coded API-key fallback, and performs broad local project mutations without enough user control.

Install only if you are comfortable sending video prompts, outlines, and narration to DashScope and letting the skill modify a local Remotion project. Before use, remove or rotate the embedded fallback key in gen_html.py, use your own credential file, review the project paths it will write/delete, and consider pinning dependencies.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: print(f" CMD: {' '.join(cmd)}") t0 = time.time() # shell=True needed on Windows so npx.cmd can be found result = subprocess.run(' '.join(cmd), cwd=str(PROJECT_DIR), shell=True) elapsed = time.time() - t0 if result.returncode != 0:
Confidence: 98% confidence
Finding: This call builds a command string with user-influenced values and executes it with shell=True, creating a classic command injection surface. The size argument is parsed directly from CLI input and output_path includes lesson_name derived from LLM/user input, so an attacker could inject shell metacharacters and execute arbitrary commands on the host.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The file-level contract explicitly says the generated HTML must not contain original narration text, but the implementation inserts `subtitle_text = narration[:50]` directly into the HTML and may also fall back to truncated narration-derived bullets. In this skill context, the narration JSON is likely course script content, so this creates a real confidentiality/integrity issue: sensitive or proprietary transcript material can be exposed despite the stated policy.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The leakage check is ineffective because it only searches for a handful of literal words like `配音` and `语气`, while actual transcript leakage occurs through copied narration content that will not necessarily contain those markers. In this file's context, that weak validation can falsely reassure users that the HTML respects non-disclosure requirements when it does not.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger phrases are broad everyday terms like '做视频' and '短视频', which can cause the skill to activate in contexts where the user did not intend to invoke an automated video-generation pipeline. Because the skill performs multi-step processing with external tools and APIs, accidental invocation can lead to unintended external API usage, file operations, and costly or privacy-impacting actions.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The usage documentation recommends running the pipeline without clearly warning users that the workflow includes cache cleanup and external DashScope API calls. This increases the risk that a user invokes the skill without understanding that local files may be deleted and that prompts or content may be sent to third-party services.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code sends full narration text to DashScope via `Generation.call` without explicit consent, warning, or a local-only mode. In a content-generation skill, narration may contain unpublished educational material or sensitive data, so silent transfer to a third-party service creates a real data exposure risk.

Missing User Warnings

Low

Confidence: 97% confidence
Finding: The script reads credentials from a local file and, if absent, falls back to a hard-coded API key-like value (`sk-...`) in source code. Embedding a secret in code is a serious credential-management flaw because it can leak through source control, logs, redistribution, or reuse by unauthorized parties.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script sends outline-derived content to an external DashScope endpoint without any explicit consent, disclosure, or data-classification check. If outlines contain proprietary lesson material, internal business content, or regulated data, this creates an unintended confidentiality risk through third-party transmission.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The script transmits user-supplied topic, industry, and audience data to a third-party API and reads a local credential file without a clear user-facing consent or privacy notice. In environments where course topics may contain confidential business or regulated information, this can cause unintended data disclosure to an external provider.

External Transmission

Medium

Category: Data Exfiltration
Content: api_endpoint = f'{base_url}/services/aigc/text-generation/generation' print(f'[DEBUG] API请求URL: {api_endpoint}') response = requests.post( api_endpoint, headers=headers, json=data
Confidence: 94% confidence
Finding: This network call transmits user/project content to an external service, which is a real security concern in an agent skill context because users may not expect local lesson outlines to leave the machine. The danger is elevated by the script's automatic behavior and lack of timeout, consent gate, or restrictions on what base URL may be used from the credential config.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Python dependencies for video pipeline edge-tts>=6.0.0 requests>=2.25.0 dashscope>=1.13.0 mutagen>=1.45.0
Confidence: 89% confidence
Finding: `edge-tts>=6.0.0` is only lower-bounded, which allows installation of any newer major or minor release, including versions with breaking changes or newly introduced malicious/supply-chain issues. In an agent skill that depends on external packages for media processing, loose version ranges reduce build reproducibility and increase exposure to upstream compromise.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Python dependencies for video pipeline edge-tts>=6.0.0 requests>=2.25.0 dashscope>=1.13.0 mutagen>=1.45.0 asyncio
Confidence: 96% confidence
Finding: `requests>=2.25.0` permits many later versions and does not ensure a known-safe release is installed, which is especially problematic because this package has had multiple published advisories. In a network-capable video pipeline skill, an unsafe or unexpected `requests` version can affect outbound HTTP behavior, credential handling, and TLS-related security assumptions.

Unpinned Dependencies

Low

Category: Supply Chain
Content: # Python dependencies for video pipeline edge-tts>=6.0.0 requests>=2.25.0 dashscope>=1.13.0 mutagen>=1.45.0 asyncio pathlib
Confidence: 87% confidence
Finding: `dashscope>=1.13.0` is unpinned and allows unreviewed future releases to enter the environment, creating avoidable supply-chain and stability risk. Because this skill appears to integrate external services, dependency drift can alter authentication, request formatting, or data handling behavior without code changes.

Unpinned Dependencies

Low

Category: Supply Chain
Content: edge-tts>=6.0.0 requests>=2.25.0 dashscope>=1.13.0 mutagen>=1.45.0 asyncio pathlib argparse
Confidence: 87% confidence
Finding: `mutagen>=1.45.0` is not reproducibly pinned, so future releases could introduce security defects or malicious package compromise into the media-processing pipeline. In content-processing workflows, parser/library changes can be especially risky because they often handle untrusted file metadata.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The requirements file allows `requests` versions from `2.25.0` upward, and the static analysis indicates the package family has multiple known advisories. Because this skill likely performs network operations, a vulnerable `requests` version could expose credentials, weaken request verification behavior, or leak sensitive data when interacting with attacker-controlled endpoints.

Static analysis

No suspicious patterns detected.