Security audit

Fableforge

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate video-production workflow, but it needs Review because it can install tools, use a personal voice clone, and commit or push project files without enough consent gates.

Install only if you are comfortable with a command-driven video workflow that changes local files, downloads tools, installs Python packages, and may create Git history. Before running it, require explicit approval for any voice clone, verify the speaker consented, review dependency downloads, and inspect git status/diffs before any commit or push.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to run `git add`, `git commit`, and `git push origin main`, which performs outbound publication to a remote repository. That exceeds core local video-generation behavior and can leak generated content, workspace data, or accidentally staged files if executed in an automated agent context.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The environment setup instructs downloading executables from external URLs via `curl` and immediately installing them into `bin/` with execute permissions. This introduces supply-chain risk and expands the skill beyond its stated content-production purpose into unaudited software acquisition and execution.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Forcing generation of platform-specific promotional copy expands the skill from video production into marketing content production without clear user consent. While not directly a code-execution risk, it can cause unauthorized or undesired content generation tied to a specific platform and business workflow.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Forcing generation of platform-specific promotional copy expands the skill from video production into marketing content production without clear user consent. While not directly a code-execution risk, it can cause unauthorized or undesired content generation tied to a specific platform and business workflow.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill directs the agent to perform host-level bootstrapping, including copying packaged resources, downloading executables from the internet, creating a Python virtual environment, and installing packages. In an agent setting, these actions materially change the local system and expand execution capability beyond simple video-workflow guidance, creating supply-chain and unauthorized system modification risk if run automatically.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The shell commands fetch external binaries via curl, unzip them, move them into an executable bin directory, and install Python dependencies, all without integrity verification. This gives the skill arbitrary environment provisioning capability that could be abused for remote code delivery or persistence, especially if the download source or dependency chain is compromised.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The SOP says the agent must preferentially use a user's voice clone from `/语音模型/voxenv` if present, without any consent, notice, or purpose limitation. Voice clones are sensitive biometric-like personal data, and automatic use can violate privacy expectations, policy, or legal requirements while enabling impersonation-style misuse.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs automatic download and installation of ffmpeg/ffprobe without any prior warning, consent, or explanation of system impact. Silent execution of network and install actions undermines user control and can expose the environment to unintended software changes or malicious payloads if the source is tampered with.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Creating a virtual environment and running pip install without user warning or consent causes unreviewed changes to the workspace and pulls code from external package sources. In an agentic context, this is dangerous because package installation is executable content delivery and may introduce compromised or unexpected dependencies.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill mandates using a user's voice clone by default whenever a local clone environment exists, but it does not require explicit informed consent, privacy notice, retention limits, or confirmation that the user owns or is authorized to use that voice. Voiceprints are highly sensitive biometric data, and defaulting into cloning can expose users to privacy violations, impersonation, and compliance risk. In this content-generation context, that makes the issue more dangerous because the workflow operationalizes voice synthesis as a routine step rather than an exceptional, consent-gated action.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README instructs users to record and retain a voiceprint sample for a voice-cloning workflow, but the warning only mentions Git exclusion and does not clearly explain that voice recordings are biometric identifiers that can enable impersonation, fraud, or irreversible privacy harm if leaked or misused. In the context of an AI video pipeline that explicitly clones a user's voice to speak arbitrary text, this omission materially increases the chance that users will underestimate the sensitivity of the data they are being asked to create and store.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.