Security audit

Video Pipeline

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent video-generation purpose, but it handles API credentials and generated web content in ways that need review before installation.

Review carefully before installing. Use an isolated project directory, rotate/remove the embedded DashScope key, provide your own scoped credential only through a trusted secret path, keep base_url on the official HTTPS DashScope host, avoid sensitive input, and sanitize generated HTML before opening or rendering it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/gen_html.py:201
Finding: Hardcoded DashScope API Credential in Source Code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/pipeline.py:58
Finding: Bearer Credential Can Be Sent to an Arbitrary Configured Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/gen_html.py:262
Finding: Unescaped User and LLM Content Is Embedded in Generated HTML
Content: View full analysis

L{index+1:02d}

{title}

__COURSE_SUBTITLE__

__COURSE_SERIES__

封面页
''' ``` LLM-generated sentences are inserted without escaping: ```python i ...[truncated 2795 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:2
Finding: Unsafe Dependency Manifest Includes Standard-Library Names and Unpinned Executable Packages
Content: View full analysis
=6.0.0 requests>=2.25.0 dashscope>=1.13.0 mutagen>=1.45.0 asyncio pathlib argparse json re shutil subprocess sys time io os ``` Installation guidance in `setup_guide.md`: ```bash pip install edge-tts requests dashscope mutagen ``` ```bash npm install remotion @remotion/cli ``` ### Technical Analysis The Python manifest incorrectly lists standard-library module names as if they were third-party PyPI dependencies. Examples include `asyncio`, `pathlib`, `argparse`, `subprocess`, `sys`, `os`, and `json`. Package managers resolve names through package indexes, not through Python's standard-library namespace. If a package with one of these names exists or later becomes available on a configured index, installation may retrieve unrelated third-party code. Python packages can execute code during build and installation, so an unnecessary dependency can become a local code-execution channel. The genuine third-party Python and Node.js dependencies are specified without exact versions or integrity hashes. Lower-bound constraints such as `requests>=2.25.0` allow future versions to be installed without review. The setup guide also installs current npm package versions without referencing a committed lockfile. ### Attack Path 1. A user follows the instructions and runs `pip install -r requirements.txt` or the unpinned installation commands. 2. The package manager resolves names against PyPI, npm, or a configured internal mirror. 3. A standard-library-like package name resolves to an unrelated third-party distribution, or an allowed dependency version changes after the Skill was reviewed. 4. The package's build or installation hooks execute with t ...[truncated 898 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (71)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
运行主入口脚本 `pipeline.py`，支持自然语言输入和传统模式：

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script’s stated rule forbids including verbatim narration in the HTML, but it later inserts narration-derived subtitle text directly into the output. If narration contains sensitive, proprietary, or policy-restricted text, this causes unintended disclosure in generated artifacts and defeats the documented privacy/content-separation guarantee.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill description and examples are written as if the interaction language is Chinese by default, and there is no indication that users may choose another language or that the Chinese-only presentation is required for a region-specific purpose. This can violate language/locale choice expectations when a skill implicitly constrains usage to one language without opt-in.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are generic everyday requests such as '做视频' and '短视频', which can cause the skill to activate in contexts broader than the user intended. In an agent environment, overbroad invocation increases the chance of accidental execution of a multi-step pipeline that may consume APIs, generate files, and send content to external services without clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly depends on DashScope API and Edge-TTS, and the pipeline description shows user-provided prompts and generated scripts being processed through external services. Without a privacy/disclosure warning, users may unknowingly transmit potentially sensitive content to third-party providers, creating confidentiality and compliance risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The documented workflow includes '缓存清理' and multi-stage file generation, but the skill description does not warn users that prior outputs or cached files may be deleted or overwritten. This creates a real risk of unintended data loss or destructive behavior when the skill is invoked, particularly in shared or reused working directories.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This TypeScript/TSX file contains all user-facing text in Chinese, including the title, labels, and summary message, but provides no indication that the skill is region-specific or that users can choose another language. Under the stated policy, hard-coding a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This TypeScript/TSX file contains user-visible text entirely in Chinese, including the title and all slide content, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clear justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This .tsx file is a code file, so only SQP-2 and SQP-3 apply. The visible strings and title are entirely in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This TSX file hardcodes all visible user-facing text in Chinese, including the title, labels, and emphasis banner. The file does not indicate that the skill is region-specific or that users can opt into this locale, which may violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This TypeScript/TSX file contains user-facing slide text entirely in Chinese, including the title and all bullet content. Under the policy rule for language/locale, presenting fixed Chinese-language content without offering a language choice or documenting a justified region-specific constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This TSX file hardcodes all visible instructional/content text in Chinese, including the title and bullet points, and provides no indication that users can choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This TSX file presents all visible instructional/content text in Chinese, including the title and bullet points, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. That creates a natural-language locale constraint without user opt-in, which matches the policy-violation category.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This TSX file contains user-facing text entirely in Chinese, including the title and body content, and does not indicate any user choice of language or a documented reason for restricting output to this locale. The policy explicitly flags language or locale constraints when a skill forces a specific language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This TSX file hard-codes all user-visible text in Chinese, including the slide title, labels, and emphasis text. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This TSX file contains user-facing text entirely in Chinese, including the title, labels, and highlight message. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation when no locale choice or justification is present in the file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This TypeScript/TSX file contains user-facing text entirely in Chinese, including the title, labels, and conclusion, with no indication that the user can select another language or that the skill is intentionally limited to a Chinese-speaking context. The policy explicitly flags language or locale constraints when they are imposed without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This .tsx file contains multiple user-facing strings in Chinese, beginning with the slide title and continuing throughout the rendered content. Under the policy, forcing a specific language without user opt-in or clear region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The entire skill file is written in Chinese, including headings, bug descriptions, and key lessons, with no indication that the skill is China-specific or that users may choose another language. This can violate language or locale policy when a skill implicitly enforces one language without opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: User-provided narration is sent verbatim to an external LLM service without explicit disclosure, consent, minimization, or data classification checks. In this skill context, narration content may contain unpublished course material or sensitive text, so transmitting it to a third party creates confidentiality and compliance risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script forwards raw narration text to a third-party LLM, increasing exposure of all user-supplied content beyond the local environment. In a content-generation workflow, this is more dangerous because users may assume processing is local, while the code silently exports potentially sensitive instructional material.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The validation logic claims to check for transcript leakage, but only searches for a few literal keywords such as '配音' and '语气'. Because the script embeds narration content directly, this check provides a false sense of safety and will miss most actual leakage cases.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: The code transmits outline-derived content to an external DashScope API, which is a real data exfiltration boundary because slide data may contain proprietary or sensitive project material. This becomes more dangerous in an agent/skill context where input files may be supplied from other workflows, and there is no consent check, redaction step, timeout, or allowlist enforcement before sending the data off-host.
Content: Scanner excerpt · scripts/gen_narration.py (reported line 72)May include surrounding context.
python
api_endpoint = f'{base_url}/services/aigc/text-generation/generation' print(f'[DEBUG] API请求URL: {api_endpoint}') response = requests.post( api_endpoint, headers=headers, json=data

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script inserts untrusted outline fields, including the full slides array, directly into a single LLM prompt with no delimiting, escaping strategy, or instruction hierarchy to reduce prompt injection risk. If the outline content is attacker-controlled, it can override generation rules, induce malformed JSON, leak contextual data from the prompt, or steer the model into producing unsafe or incorrect narration output.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script reads an API key from a user-specific credentials file and sends prompt content to a third-party API service without any explicit notice, consent flow, or scoping of what data may leave the local environment. In an agent/skill context, this can cause unintended disclosure of sensitive project or user-provided content and silently consume privileged credentials.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.