LovTrip Video to Article

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:18 AM UTC
• Version: 1.1.0

Overview

The skill does what it says, but its recommended MCP setup runs an unpinned npm package with the user's local privileges and Gemini API key.

Install only if you are comfortable with a persistent MCP configuration that runs lovtrip from npm. Prefer a pinned, reviewed package version or the included standalone script, use a restricted Gemini API key with quotas, and submit only public YouTube videos you are willing to send to Google Gemini.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:21

Finding

Unpinned Third-Party Package Is Automatically Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-28
Vulnerability Type: Supply-chain exposure through unpinned package execution
Risk Level: High

Vulnerable Code

json

{
  "mcpServers": {
    "lovtrip": {
      "command": "npx",
      "args": ["-y", "lovtrip@latest", "mcp"],
      "env": {
        "GEMINI_API_KEY": "your-gemini-api-key"
      }
    }
  }
}

Technical Analysis

The recommended MCP configuration invokes npx with both -y and lovtrip@latest. This causes npm to download and execute whichever package version is currently published under that name without interactive confirmation, an exact version constraint, an integrity hash, or a project lockfile.

The effective executable can therefore change after this Skill has been reviewed. Although the audited standalone script does not download executable code, following the recommended setup delegates execution to an externally maintained and mutable npm package.

This violates least-privilege and reproducibility principles because downloaded package code executes with the invoking user's local permissions and receives the configured GEMINI_API_KEY through its environment.

Attack Path

1. An attacker compromises the npm publisher account, package repository, build pipeline, or a future package release.
2. The attacker publishes a malicious version under the lovtrip package name.
3. A user follows the documented MCP configuration.
4. npx -y lovtrip@latest mcp retrieves the malicious release and executes it without confirmation.
5. The package reads GEMINI_API_KEY from its environment and may access any other files, credentials, network resources, or processes available to the invoking user.
6. The malicious code can exfiltrate data or perform arbitrary actions within that user's privilege boundary.

Impact Assessment

Successful exploitation can provide arbitrary code execution with the privileg ...[truncated 585 chars]

Remediation

View remediation

Remediation Suggestions

• Replace lovtrip@latest with an exact, reviewed version such as lovtrip@x.y.z.
• Commit a lockfile and enforce package integrity verification where the surrounding installation model supports it.
• Avoid npx -y for security-sensitive execution because it suppresses confirmation before downloading and running code.
• Prefer shipping reviewed implementation code with the Skill or installing dependencies through a controlled build process.
• Run the MCP server under a dedicated, restricted account or sandbox with access only to required resources.
• Supply only the required API key to the process and prevent inheritance of unrelated secrets.
• Establish a dependency update process that reviews source changes, package provenance, and integrity before changing the pinned version.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/video2article.mjs:91

Finding

Gemini API Key Is Embedded in the Request URL

Content

View full analysis

Vulnerability Details

File Location: scripts/video2article.mjs:14,91-98
Vulnerability Type: Sensitive credential exposure through URL query parameters
Risk Level: Medium

Vulnerable Code

js

const GEMINI_API_KEY = process.env.GEMINI_API_KEY;

js

const url = `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-pro:generateContent?key=${GEMINI_API_KEY}`;

const response = await fetch(url, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify(requestBody),
});

Technical Analysis

The API key is read from an environment variable and interpolated directly into the URL query string. The request uses HTTPS and targets the official Google Gemini endpoint, so this is not evidence of covert exfiltration: transmitting an authentication credential to Gemini is necessary for the declared video-to-article functionality.

However, credentials in URLs have a larger accidental disclosure surface than credentials carried in authentication headers. Full URLs may be captured by HTTP proxies, observability agents, tracing systems, diagnostic tooling, exception telemetry, or debug logs. HTTPS protects the request while in transit but does not prevent endpoint software or locally trusted infrastructure from recording the URL.

The script does not intentionally print the constructed URL or API key. Exploitation therefore depends on URL-observing infrastructure or diagnostic tooling present in the execution environment.

Attack Path

1. A user runs the script in an environment containing a proxy, tracing agent, network diagnostic tool, or logging layer that records outbound request URLs.
2. The script constructs a Gemini endpoint URL containing the API key in its query string.
3. The infrastructure records or exports the complete URL.
4. An attacker or unauthorized operator obtains access to those logs or telemetry records.
5. The attacker ...[truncated 781 chars]

Remediation

View remediation

Remediation Suggestions

• Use an API-supported authentication header instead of a query parameter where supported by the Gemini endpoint and client configuration.
• If query-parameter authentication is required, configure proxies, tracing systems, and application telemetry to redact the key parameter.
• Do not include complete request URLs in error messages, debug output, or exception telemetry.
• Restrict the API key to only the required Gemini/Generative Language API.
• Apply suitable quotas, billing alerts, and usage monitoring.
• Use separate keys for separate environments and workloads to reduce exposure scope.
• Rotate the key immediately if it may have appeared in logs, and establish a regular credential-rotation procedure.
• Continue loading the key from an environment variable or a dedicated secret manager rather than hardcoding it in source files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Lp1

High

• Category: MCP Least Privilege
• Confidence: 97% confidence

Finding

The code performs outbound HTTP requests to generativelanguage.googleapis.com and also passes a user-supplied videoUrl to the external model API. If network capability is undeclared, the skill can exfiltrate user inputs or metadata to third parties without transparent authorization, which is a real security and privacy concern in permissioned skill systems.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 97% confidence

Finding

The code performs outbound HTTP requests to generativelanguage.googleapis.com and also passes a user-supplied videoUrl to the external model API. If network capability is undeclared, the skill can exfiltrate user inputs or metadata to third parties without transparent authorization, which is a real security and privacy concern in permissioned skill systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to submit a YouTube URL for processing by Google Gemini but does not clearly warn that user-provided URLs and derived video content are sent to a third-party AI service. This creates a transparency and privacy issue: users may unknowingly disclose sensitive, private, or policy-restricted content to an external processor, especially if they assume processing is local or confined to LovTrip.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script sets the default language to 'Chinese (Simplified)' when the user does not provide a language argument. This imposes a specific locale by default rather than offering a neutral default or explicit opt-in, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.