FableForge AI Video Studio

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 1.0.1

Overview

This video-production skill has useful, coherent goals, but it asks for sensitive voice cloning, unverified tool downloads, unsafe dependency execution, and possible remote Git publishing without enough safeguards.

Review before installing. Use this only in a disposable or dedicated video project, pin and verify all dependencies and downloaded binaries, remove curl -k, require explicit consent before any cloned-voice use, add a real .gitignore for voice samples, and disable any automatic git push until the exact diff, remote, and branch are approved.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: resources/stages/stage_1_creatives.md:184
• Finding: Mandatory Promotional Content Hijacks User Deliverables<![CDATA[ ## Vulnerability Details **File Location**: `resources/stages/stage_1_creatives.md:184-202`; related requirement in `resources/stages/stage_5_publish.md:14-44` **Vulnerability Type**: Forced promotional output and engagement solicitation **Risk Level**: High ### Vulnerable Source Snippet The following is an English rendering of the mandatory output specified at line 202: ```text The layout content is fixed as: "Like | Favorite Follow See you next time! — [User-specified brand name]" ``` The publishing stage additionally requires the script to contain: ```markdown ## 5. Xiaohongshu Promotional Plan ### Viral Title Recommendations 1. [Title 1] 2. [Title 2] 3. [Title 3] ### Cover Text Recommendations - **Main title**: [Concise and forceful] - **Subtitle**: [Theme or contrast] ### Xiaohongshu Post [A 300–500 character social post containing extensive emoji, actionable points, an engagement question, and popular hashtags] ``` ### Technical Analysis The Skill does not merely offer promotional material when requested. It mandates a fixed engagement end card and requires platform-specific marketing copy to be appended to the generated script. This changes the user's requested deliverable by inserting unsolicited calls to like, favorite, follow, comment, and distribute content. Because these requirements are expressed as mandatory workflow gates, an agent loading the Skill is directed to produce this material even when the user only requests video creation. This is stable instruction-level output manipulation. ### Attack Path 1. A user asks the agent to create a video without requesting promotional material. 2. The agent loads the Skill and follows Stage 1. 3. Stage 1 requires the generated end card to contain fixed engagement prompts. 4. Stage 5 requires a Xiaohongshu promotional plan, engagement question, emoji, and hashtags. 5. The unsolicited promotional content becomes part of the project deliverables. ### Impact Assessment The issue can al ...[truncated 283 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make end-card engagement prompts optional and disabled by default. - Ask the user whether promotional assets are wanted before generating them. - Separate core video production from optional social-media publishing workflows. - Remove mandatory language and fixed engagement text. - Require explicit approval of the exact promotional copy and attributed name before inserting it. - Ensure a user can complete every production stage without generating Xiaohongshu or other platform-specific marketing content. ]]>

T08 · Insecure Dependencies

Error

• Location: resources/stages/stage_0_env.md:27
• Finding: Mutable and Unpinned Dependencies Are Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `resources/stages/stage_0_env.md:27-32`; `resources/stages/stage_2_timeline.md:15`; `resources/stages/stage_4_animation.md:30-43` **Vulnerability Type**: Unpinned package installation and execution **Risk Level**: High ### Vulnerable Code Snippet ```bash python3 -m venv voice-model/venv source voice-model/venv/bin/activate pip install voxcpm soundfile torch numpy ``` ```bash npx hyperframes transcribe YYYYMMDD/assets/narration.wav ``` ```bash export PATH=./bin:$PATH npx hyperframes@latest inspect YYYYMMDD/ npx hyperframes@latest render YYYYMMDD/ -o YYYYMMDD/renders/promo_video.mp4 --force-new ``` ### Technical Analysis The Python dependencies are installed without exact versions, hashes, or a lockfile. The Node CLI is invoked through `npx`, including explicit use of the mutable `@latest` tag. Consequently, the executable code retrieved during a future Skill run can differ from the code available when the Skill was audited. Both package ecosystems can execute package-controlled code. Python packages may run build-system logic during installation, while `npx` downloads and runs package entry points. A compromised registry account, malicious release, dependency confusion event, or unexpected upstream update can therefore result in local code execution. ### Attack Path 1. The user initializes, transcribes, inspects, or renders a project. 2. The workflow resolves packages from public package registries. 3. A mutable package version is downloaded. 4. Installation hooks, build logic, or the CLI entry point executes with the agent's operating-system permissions. 5. A compromised release can read project files, alter output, access credentials available to the process, or execute additional commands. ### Impact Assessment Successful exploitation provides code execution with the same privileges as the agent process. The accessible scope can include the current project, user-readable files, environment variab ...[truncated 171 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin every Python and Node dependency to an exact reviewed version. - Supply a Python requirements file with SHA-256 hashes and install with hash enforcement. - Supply and enforce a package-lock file for Node dependencies. - Remove all uses of `@latest`. - Install dependencies during a separately approved setup phase rather than implicitly during content generation. - Review package provenance, maintainers, transitive dependencies, and lifecycle scripts. - Use a restricted environment with minimal filesystem access, no unnecessary credentials, and constrained outbound networking. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: resources/stages/stage_0_env.md:17
• Finding: Unverified External Executables Are Downloaded and Trusted<![CDATA[ ## Vulnerability Details **File Location**: `resources/stages/stage_0_env.md:17-24` **Vulnerability Type**: Unverified remote executable retrieval **Risk Level**: High ### Vulnerable Code Snippet ```bash curl -L https://evermeet.cx/ffmpeg/get/zip -o ffmpeg.zip && unzip -o ffmpeg.zip curl -L https://evermeet.cx/ffmpeg/get/ffprobe/zip -o ffprobe.zip && unzip -o ffprobe.zip mkdir -p bin && mv ffmpeg bin/ && mv ffprobe bin/ && chmod +x bin/* rm ffmpeg.zip ffprobe.zip ``` ### Technical Analysis The initialization workflow downloads FFmpeg and FFprobe executables from a third-party endpoint, extracts them, marks them executable, and later places their directory at the beginning of `PATH`. It does not pin a release or verify a cryptographic digest or signature. Although HTTPS protects transport under normal conditions, it does not establish artifact immutability. A compromised distribution server, account, endpoint, or upstream artifact can replace the binaries after the Skill has been reviewed. The archive is also extracted without first checking its contents. ### Attack Path 1. A user asks the Skill to initialize a project. 2. The workflow downloads mutable FFmpeg and FFprobe archives. 3. A compromised endpoint returns modified binaries. 4. The workflow extracts the files and grants execute permission. 5. Later stages prepend `./bin` to `PATH` and invoke `ffmpeg` or `ffprobe`. 6. The substituted executable runs attacker-controlled code with the agent's permissions. ### Impact Assessment A malicious binary can obtain arbitrary code execution as the invoking user. It can read and modify project files, inspect environment variables, access user-readable credentials, modify rendered output, and communicate over available network connections. The audit found no mechanism that elevates it above the invoking operating-system account. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer operating-system package managers or official signed releases. - Pin an exact FFmpeg release and platform-specific artifact. - Store expected SHA-256 digests in the reviewed Skill and verify them before extraction. - Verify an official cryptographic signature where available. - Reject archives containing unexpected paths, symlinks, or additional executables. - Download to a private temporary directory and use atomic installation only after verification. - Do not prepend a project-controlled directory to `PATH`; invoke a verified binary by an explicit absolute path. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: resources/stages/stage_1_creatives.md:150
• Finding: B-Roll Downloader Disables TLS Certificate Verification<![CDATA[ ## Vulnerability Details **File Location**: `resources/stages/stage_1_creatives.md:150-179` **Vulnerability Type**: Improper certificate validation in generated download logic **Risk Level**: Medium ### Vulnerable Code Snippet ```python VIDEO_MAP = { "scene1.mp4": {"url": "https://videos.pexels.com/...", "is_vertical": True}, "scene2.mp4": {"url": "https://videos.pexels.com/...", "is_vertical": False}, } ``` ```bash curl -L -k --retry 5 --retry-delay 3 -H "User-Agent: Mozilla/5.0 ..." ``` ```bash export PATH=./bin:$PATH python3 download_and_process.py ``` ### Technical Analysis The required downloader specification includes the `curl -k` option. This disables TLS certificate-chain and hostname verification. Encryption without authentication does not prevent an active network attacker from impersonating the media host. The subsequent `ffprobe` validation only establishes that the downloaded file appears to be parseable media. It does not establish its origin, licensing, expected content, or integrity. An attacker can therefore substitute another valid video and still pass that check. ### Attack Path 1. The Skill generates `download_and_process.py` according to the required specification. 2. The script downloads B-roll over HTTPS with certificate verification disabled. 3. An attacker controlling a network path impersonates the requested host. 4. The attacker returns a different but structurally valid media file. 5. `ffprobe` accepts the substituted file. 6. The content is cropped and embedded in the final rendered video. ### Impact Assessment The demonstrated impact is content substitution, deceptive output, and potential introduction of untrusted parser inputs. Exploitation does not inherently grant system privileges, but a specially crafted media file could also exercise vulnerabilities in the installed FFmpeg build. The affected scope includes all B-roll assets downloaded by this workflow and any final videos containing them. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the `-k` option and fail closed on certificate errors. - Use the operating system's current trusted certificate store. - Restrict redirects to an allowlist of expected HTTPS hosts. - Validate the final URL, MIME type, file size, codec, dimensions, and duration. - Record the source URL and a cryptographic digest for every downloaded asset. - Treat media parsing and transcoding as untrusted-input processing and perform it in a sandbox with resource limits. - Provide a manual fallback rather than weakening TLS when a certificate error occurs. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.en.md:397
• Finding: English Workflow Automatically Pushes Repository Content to a Remote Branch<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.en.md:397-408` **Vulnerability Type**: Remote repository modification without an explicit confirmation gate **Risk Level**: High ### Vulnerable Code Snippet ```bash git add YYYYMMDD/ README.md git commit -m "feat: Add {video_title} project" git push origin main ``` ```markdown **Stage 5 Exit Criteria:** - Script file contains full metadata - README demo works table updated - `git push` successful ``` ### Technical Analysis The English workflow makes a successful push to `origin/main` an exit criterion. It does not require the agent to display the remote URL, branch, staged files, or diff and obtain explicit user authorization immediately before publication. This conflicts with `resources/stages/stage_5_publish.md:48-55`, which permits a local commit but expressly leaves pushing to the user. Depending on which document the agent follows, the same Skill can therefore perform materially different external side effects. ### Attack Path 1. The user requests completion or archiving of a video project. 2. The English workflow stages the generated project and `README.md`. 3. It creates a local commit. 4. Existing Git credentials are used to push directly to `origin/main`. 5. Project data becomes available to the configured remote, and the shared branch is modified without a dedicated confirmation step. ### Impact Assessment The workflow can modify a remote repository within the permissions of the user's existing Git credentials. It may disclose generated assets, metadata, authorship information, and other accidentally staged project contents. It can also alter a protected or shared branch if the credentials and repository policy permit it. No acquisition of permissions beyond existing Git credentials is demonstrated. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove automatic `git push` execution from the workflow. - Require explicit, just-in-time confirmation before any remote operation. - Display the resolved remote URL, target branch, commit identifier, and complete staged-file list before confirmation. - Run a sensitive-file scan before staging and before pushing. - Default to a local commit only, or produce a patch for the user to review. - Reconcile the English and modular publishing instructions so both enforce the same no-automatic-push policy. - Prefer a new review branch instead of pushing directly to `main`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: resources/voice-model/README.md:64
• Finding: Biometric Voice Sample Is Claimed to Be Excluded Without a Shipped Git Ignore Rule<![CDATA[ ## Vulnerability Details **File Location**: `resources/voice-model/README.md:64-68` **Vulnerability Type**: Misleading protection for sensitive biometric data **Risk Level**: Medium ### Vulnerable Source Snippet The source documentation makes the following privacy claim, rendered in English: ```text Privacy notice: This file contains your voiceprint information. The `.gitignore` file has automatically excluded the `01_samples/` directory, so it will not be committed to GitHub. ``` The documented sensitive file location is: ```text voice-model/01_samples/my_voice.wav ``` No `.gitignore` file was present in the audited project structure. ### Technical Analysis A voice recording suitable for voice cloning is biometric and impersonation-sensitive data. The documentation assures users that the sample directory is automatically excluded from Git, but the audited package does not contain the claimed `.gitignore`. This creates a false security assumption. A user or agent may run broad staging commands in a parent repository and commit the sample. The risk is amplified by the Skill's Git archiving and remote-push workflows. ### Attack Path 1. The user records a voice sample and saves it at the documented path. 2. The user relies on the statement that the sample is automatically ignored. 3. The project is placed inside a Git working tree. 4. A broad staging operation includes the unignored voice sample. 5. A later commit or remote push publishes the biometric recording. 6. Anyone with repository access can copy the recording and potentially use it for voice impersonation. ### Impact Assessment The affected asset is the user's raw voice recording and associated voiceprint characteristics. Disclosure can enable impersonation, unauthorized voice cloning, social-engineering content, or long-term privacy harm. Git history may preserve the recording even after ordinary file deletion. The issue does not itself grant operating-system privileges. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Ship a verified `.gitignore` containing at least: ```gitignore voice-model/01_samples/ **/01_samples/ ``` - Verify with `git check-ignore` that the sample is excluded before allowing Git archival. - Add a pre-commit check that rejects WAV files and known voice-sample paths. - Store biometric samples outside the repository by default and reference them through an explicit local path. - Require explicit informed consent before cloning or retaining a voice. - Document retention and deletion procedures. - If a sample was committed, remove it from repository history and rotate or revoke any published artifacts derived from it where feasible. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (36)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Defaulting to cloned-user-voice output without a warning or explicit consent is a clear safety and privacy issue. Voiceprints are sensitive biometric artifacts, and unauthorized or surprising use can enable impersonation, reputational harm, or misuse of previously stored user assets.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```

**下载容错规范：**
- `curl -L -k --retry 5 --retry-delay 3 -H "User-Agent: Mozilla/5.0 ..."` — Pexels CDN 需要浏览器 UA，且 SSL 连接不稳定
- 若 curl 返回非零但文件通过 `ffprobe` 校验 → 视为下载成功（Cloudflare 常在传输末尾断开连接）
- 已存在的有效视频自动跳过（断点续传）

• Confidence: 98% confidence
• Finding: The instruction to use `curl -k` disables TLS certificate verification, weakening transport security for external downloads. In a workflow that fetches media from the internet, this makes man-in-the-middle interception or content substitution easier, especially when combined with automatic processing of downloaded files.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Deduplication check**: Before generating, scan all `YYYYMMDD/script-template.md` files in the workspace to ensure the theme does not repeat a previous work.

⛔ **After this step: STOP. Present the full allegory to the user and await explicit confirmation. Do not continue without confirmation.**

### 1.2 Storyboard Conversion (after user confirmation)

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to automatically prefer a user voice-clone environment for narration generation, which can expose highly sensitive biometric voice data and normalize unauthorized cloning. Because it is framed as the default and mandatory path, it reduces the chance of meaningful consent or privacy review before using identity-linked assets.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Mandating the user's voice clone without any user-facing privacy disclosure is dangerous because voiceprints are biometric identifiers and generated speech may be mistaken for authentic speech from the user. The lack of warning and consent language makes misuse or unintentional privacy violations significantly more likely in normal operation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence
• Finding: The skill invokes `npx hyperframes transcribe` without pinning an exact package version, which allows whatever version is current in the registry at execution time to run in the user's environment. That creates a supply-chain and reproducibility risk, especially because `npx` may download and execute remote code implicitly.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill includes direct `git add`, `git commit`, and `git push origin main` instructions, enabling publication of generated artifacts and repository changes to a remote without an explicit per-run confirmation gate. In an agent context, this can leak sensitive content, overwrite trusted branches, or exfiltrate workspace data through normal version-control operations.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill advertises automated environment deployment, downloading static ffmpeg/ffprobe binaries, and building an isolated Python environment without prominently warning that it will change the local system/workspace. Even if confined to the project, these actions introduce supply-chain and integrity risks because they fetch and execute external tooling.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill includes external media/API retrieval and automated content collection, including image APIs and B-roll downloads, but does not clearly disclose those networked actions in the top-level description. This can expose users to unreviewed third-party content, licensing issues, and unexpected data transfer or API usage.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The Stage 5 publication flow states it will update README and create a local Git commit automatically, but this is not clearly disclosed as a system-modifying action in the skill summary. Silent repository modification can leak generated or unrelated files into version control and may trigger downstream automation tied to commits.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The stage instructs the agent to download external binaries and install Python packages, which expands behavior from content-generation SOP into system provisioning and supply-chain interaction. This is dangerous because it causes network access, filesystem modification, and execution of third-party software without clear trust boundaries, pinning, or integrity verification.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The instructions automate downloads and package installation without first warning the user that network access, dependency retrieval, and filesystem changes will occur. This is dangerous because users may unknowingly authorize risky supply-chain actions or environment modifications they did not intend.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill directs shell-based provisioning commands that download archives, move executables into a local bin directory, create a virtualenv, and install packages. This is dangerous because an agent following these instructions could perform impactful local system changes and execute unreviewed dependency installation without the manifest justifying such operational capability.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The prescribed user-facing prompt is written in Chinese and directs the agent to present that exact message, which imposes a specific language without user opt-in. There is no indication that the skill is region-specific or that the user may choose another language.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file specifies narration as `中文30~80字` and later requires `ONLY Chinese typography`, imposing a specific language/locale in the instructions. There is no indication that the user can choose another language or opt in to Chinese output.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill mandates checking for a local voice-cloning environment and automatically using the user's cloned voiceprint if present. That creates a biometric/privacy risk and expands behavior beyond a generic video SOP by defaulting to sensitive voice synthesis without explicit informed consent, purpose limitation, or confirmation that the voice model belongs to and may be used for this project.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The SOP instructs copying, editing, and executing local Python scripts and shell commands in specific filesystem locations. This broadens the skill from content guidance into operational code execution, which can trigger unintended local actions, expose host paths, and normalize running unreviewed scripts derived from templates.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The B-roll workflow directs automated network retrieval from external sites plus FFmpeg-based local processing. This adds network and command-execution behavior not clearly bounded by the manifest and can introduce supply-chain, legal, and local file-handling risks if the downloaded media or commands are not tightly controlled.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The prompt construction requires `ONLY Chinese typography filling the entire frame`, which enforces a language constraint at the skill level. The document does not offer alternative language choices or user opt-in for this locale restriction.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This markdown file contains user-facing operational instructions exclusively in Chinese, and nowhere indicates that the skill is China-specific or that users may choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The document instructs users to run `npx hyperframes transcribe` without pinning an exact package version. `npx` may fetch the latest package from a registry at execution time, so a compromised upstream package, malicious update, or typo-squatted dependency could result in arbitrary code execution on the operator's machine. In this skill context, the command is presented as part of a standard production pipeline, which makes users more likely to run it directly and increases practical risk.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The entire skill document is written in Chinese and does not indicate that language choice is optional or user-selectable. Under the stated policy, forcing a specific language without opt-in is a natural-language locale policy violation unless clearly justified.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The instruction `npx hyperframes lint .` executes a package by name without pinning an exact version, which can pull whatever version is current at runtime. In a skill/SOP context, this creates a supply-chain risk: users may run unexpected code from a newly published, compromised, or behavior-changing package version during validation.

Static analysis

No suspicious patterns detected.