LrshuAI Text To Video

• Outcome: Review
• Latest audit: May 28, 2026 · 4:45 AM UTC
• Version: 1.0.0

Overview

This skill appears to generate videos through a remote API, but it under-discloses that a local script can send API credentials, prompts, and local media to an environment-selected endpoint.

Review this before installing. Use it only with a least-privilege API key, confirm TEAM_BASE_URL points to the intended trusted HTTPS service, and avoid passing private prompts or local media unless you are comfortable uploading them to that provider. Expect remote processing and possible API costs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tainted flow: 'endpoint' from os.getenv (line 39, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

print(f"Invoking model: {args.model} ...")
    try:
        response = requests.post(endpoint, headers=headers, json=payload)
        response.raise_for_status()
        result = response.json()

• Confidence: 95% confidence
• Finding: The POST target is derived from the TEAM_BASE_URL environment variable and the request includes the Bearer API key plus user-supplied prompt and optional base64-encoded local image/video data. If an attacker can influence that environment variable, the script will exfiltrate credentials and sensitive content to an arbitrary server, which is especially risky because the default behavior already transmits data off-host to a remote API.

Tainted flow: 'poll_endpoint' from os.getenv (line 132, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

while True:
            time.sleep(3) # 每3秒查询一次
            poll_resp = requests.get(poll_endpoint, headers=headers)
            poll_resp.raise_for_status()
            poll_data = poll_resp.json()

• Confidence: 90% confidence
• Finding: The polling GET request uses poll_endpoint built from the same environment-controlled base URL, continuing to send the Authorization header to whatever host is configured. This extends the exfiltration window and could leak task identifiers, metadata, and credentials to an attacker-controlled endpoint over repeated requests.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares required environment access and instructs execution of a local Python script, but the manifest does not explicitly declare permissions despite having code capabilities that can use credentials and make network requests. This weakens policy enforcement and user awareness, increasing the chance that a caller invokes code with broader access than expected.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill is presented as text-to-video only, but the reported behavior includes multimodal inputs, remote URL fetching, and broader model invocation. That mismatch is dangerous because users and orchestrators may grant or trigger the skill under narrower assumptions, while the implementation can process external resources and more complex inputs than advertised.

Vague Triggers

Medium

• Confidence: 74% confidence
• Finding: The trigger text says to call the skill whenever the user needs video generation from text, but it lacks clear limits, confirmation requirements, or safety gates before executing a local command. Broad invocation criteria can cause over-triggering of code execution and unnecessary use of sensitive credentials or paid external APIs.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The markdown tells the agent to directly execute a local Python script, yet it does not prominently warn that this performs code execution and uses an API credential from the environment. Hidden execution and secret usage reduce transparency and make accidental or uninformed invocation more likely.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script uploads the prompt and, when local paths are supplied, the full contents of images and videos encoded in base64 to a remote API, but it provides no explicit warning, consent gate, or visibility into where that data is being sent. In a skill context that may be invoked by an agent on behalf of a user, this increases the risk of accidental disclosure of sensitive local media and prompts.

Static analysis

No suspicious patterns detected.