Security audit

Fableforge

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent video-production skill, but it asks agents to install and run unverified tools, use voice cloning by default, and perform repository actions that need careful user review.

Install only if you are comfortable with a video-generation SOP that modifies the workspace, downloads executable tools and media, installs packages, and may use a voice clone. Before running it, require confirmation for all downloads, package installs, voice-clone use, Git commits, and any push; add real .gitignore protection for voice samples; remove curl -k; pin and verify dependencies; and review all generated promotional content before rendering or publishing.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: resources/stages/stage_1_creatives.md:196
Finding: Mandatory Promotional Content Injection into User Deliverables
Content: View full analysis

👍 Like ⭐ Favorite

🔔 Follow

See you next time! — {signature}

``` Stage 5 also requires promotional material to be appended: ```text At the bottom of the video script, mandatorily append a Xiaohongshu-specific promotional plan containing: 1. At least 3-4 viral title recommendations. 2. Cover-image text recommendations. 3. A 300-500-character promotional post with emojis, an interaction hook, and popular hashtags. ``` ### Technical Analysis The Skill changes the expected output contract by requiring engagement prompts and platform-specific marketing material in every deliverable. These requirements are not conditional on the user's request or explicit approval. Because the instructions are marked as fixed or mandatory, an Agent following the Skill will insert promotional content even when the user only requested video generation. This is a direct alteration of the Agent's session goals and final output. ### Attack Path 1. A user loads the Skill to create a video. 2. The Agent f ...[truncated 741 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: resources/stages/stage_0_env.md:20
Finding: Execution of Unverified and Unpinned Third-Party Dependencies
Content: View full analysis
Remediation: View remediation
` only with a reviewed lock and integrity policy, or install from a controlled local environment. 5. Download FFmpeg from a trusted official or approved distribution source. 6. Publish expected SHA-256 hashes in the Skill and verify them before extraction or execution. 7. Prefer signature verification where upstream signatures are available. 8. Extract archives into a temporary directory and verify expected filenames before moving binaries into `bin/`. 9. Run media tools and package installation in a sandbox with minimal filesystem and network access. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: resources/stages/stage_1_creatives.md:163
Finding: TLS Certificate Verification Disabled for Media Downloads
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: resources/template/index.html:35
Finding: Remote JavaScript Executed Without Subresource Integrity
Content: View full analysis
``` ### Technical Analysis The template loads executable JavaScript from a third-party CDN every time the document is previewed or rendered. Although the URL includes a version number, no Subresource Integrity hash is provided. If the CDN response is altered, the browser will execute the changed content in the document context. This makes the effective executable payload dependent on an external server after the Skill has been audited. ### Attack Path 1. A generated project is opened in a browser or rendering runtime. 2. The document requests GSAP from the external CDN. 3. The CDN account, delivery path, or dependency artifact is compromised. 4. A modified JavaScript response is returned. 5. The browser executes the response in the project page. 6. The script can alter the composition, inspect page data, and make network requests subject to the runtime's security model. ### Impact Assessment The direct scope is the HTML rendering context. A malicious script could: - Alter subtitles, images, timelines, or rendered content. - Read data exposed to the page. - Send page-accessible information to a remote service. - Trigger network requests. - Abuse additional capabilities if the rendering environment exposes privileged browser or Node.js integrations. The repository does not show that the current CDN resource is malicious; the risk results from missing integrity enforcement. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: resources/voice-model/README.md:62
Finding: Voice-Biometric Sample Is Not Protected by the Claimed Git Exclusion
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.en.md:397
Finding: English Workflow Automatically Pushes Repository Changes Without a Confirmation Gate
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (33)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The workflow explicitly recommends curl -k, which disables TLS certificate validation when downloading remote media. That makes the agent trust potentially spoofed HTTPS endpoints and enables man-in-the-middle delivery of tampered files; in this skill, the danger is amplified because downloaded content is then treated as valid if ffprobe passes, which checks media structure rather than authenticity.
Content: Scanner excerpt · resources/stages/stage_1_creatives.md (reported line 163)May include surrounding context.
text
**下载容错规范：** - `curl -L -k --retry 5 --retry-delay 3 -H "User-Agent: Mozilla/5.0 ..."` — Pexels CDN 需要浏览器 UA，且 SSL 连接不稳定 - 若 curl 返回非零但文件通过 `ffprobe` 校验 → 视为下载成功（Cloudflare 常在传输末尾断开连接） - 已存在的有效视频自动跳过（断点续传）

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.en.md (reported line 117)May include surrounding context.
md
**Deduplication check**: Before generating, scan all `YYYYMMDD/script-template.md` files in the workspace to ensure the theme does not repeat a previous work. ⛔ **After this step: STOP. Present the full allegory to the user and await explicit confirmation. Do not continue without confirmation.** ### 1.2 Storyboard Conversion (after user confirmation)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill directs the agent to access a local user voice-clone environment and copy/run local cloning scripts by default. That expands scope from generic media generation into identity-adjacent biometric processing and local file/system access, creating privacy, consent, and misuse risks if the agent uses a voice clone without explicit user approval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The SOP says the agent must use the user's voice clone by default if the environment exists, without any consent, privacy, or impersonation warning. Because voice data is biometric and can be used for identity mimicry, a default-use instruction materially increases the risk of non-consensual cloning or misleading synthetic speech generation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The skill invokes npx hyperframes without pinning an exact package version, which allows whatever version is current in the registry at execution time to be fetched and run. In an agent setting this creates a supply-chain risk: a compromised, typosquatted, or breaking upstream release could execute unintended code on the user's machine.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill includes repository modification, commit, and remote push steps as part of the SOP, which grants the agent authority to change and publish project state beyond simple video generation. In an agent context, this can cause unauthorized code/content publication, leakage of generated assets or metadata, and unintended modification of version-controlled files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The environment setup instructs downloading and installing executable binaries via curl and unzip directly into the local environment, without warning or verification steps. This exposes users to supply-chain compromise and unsafe local environment modification if the download source is tampered with or the commands are run automatically by an agent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to download static ffmpeg/ffprobe binaries, fetch B-roll media, and acquire background music, but it does not clearly warn the user that network access and third-party transfers will occur. In an agent setting, silent external downloads can expose prompts, project metadata, or usage patterns to outside services and can introduce supply-chain risk from untrusted binaries or media sources.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to perform network downloads and modify the local filesystem automatically, but it does not require an explicit warning or fresh user consent before doing so. This is dangerous because it changes the user's environment, fetches executable tooling from the internet, and could expose users to supply-chain or integrity risks if the remote resource is replaced, intercepted, or simply unexpected in their environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs automatic creation of a Python virtual environment and installation of packages without warning the user that code will be installed and executed locally. This is risky because package installation can run setup logic, consume system resources, alter the workspace, and introduce supply-chain exposure, especially when the user has not explicitly consented to environment changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script template requires narration to be in Chinese and allows visuals with Chinese text, and later poster generation explicitly requires only Chinese typography. This is a natural-language locale constraint presented as mandatory behavior, with no user opt-in or alternative language option.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The entire skill guidance is written as a prescriptive workflow in Chinese, including required labels and output conventions, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only regional context. Under the language/locale policy rule, a skill that effectively forces one language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The command npx hyperframes transcribe ... invokes a package without pinning an exact version, which can cause unreviewed upstream code to be fetched and executed at runtime. In a production SOP, this creates supply-chain risk: a compromised or breaking new release could alter outputs, execute malicious install scripts, or introduce unsafe behavior on operator machines.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: This markdown file is written entirely in Chinese and presents all required on-screen text examples, CTA text, and instructions in Chinese without offering any language or locale choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The document instructs users to run npx hyperframes inspect without pinning an exact package version. npx may fetch and execute the latest published package at runtime, which creates a supply-chain risk if the package is compromised, typosquatted, or updated with breaking or malicious behavior. In this skill context, that risk is more credible because the command is presented as a required validation step in a production SOP.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The stage exit criteria require npx hyperframes lint . without an exact version pin. This can cause arbitrary third-party code to be downloaded and executed during linting, exposing users to supply-chain compromise and non-reproducible builds. Because it is framed as a mandatory quality gate, users are more likely to execute it automatically, increasing practical risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file contains user-facing operational instructions exclusively in Chinese, and there is no note offering an alternate language or stating that the skill is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The workflow executes npx hyperframes without pinning an exact package version, which allows the latest published package to be fetched at execution time. In a build/render pipeline, that creates a supply-chain risk: a compromised upstream release or unexpected breaking change could execute unreviewed code on the operator's machine or CI environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The pre-render checklist references npx hyperframes lint without a pinned version, so the command may resolve to whatever package version is current at runtime. Because npx can download and execute remote code, this exposes the local workstation or CI runner to supply-chain compromise and undermines reproducibility of the security gate.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The instruction npx hyperframes render is unpinned and therefore can execute a newly published package version during a sensitive rendering step. In this skill's context, users are explicitly told to run the command locally, which makes the document operationally dangerous because it turns documentation into a direct path for remote code execution via the package registry.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The stage explicitly instructs adding a '声纹' field that includes cloned voice metadata such as 'VoxCPM2 用户克隆', normalizing publication and archival of biometric/voice-clone provenance without any privacy, consent, or disclosure guidance. In a production pipeline for public video distribution, this can lead to unauthorized use or exposure of biometric identifiers, weak consent practices, and downstream compliance/privacy violations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Line L34 specifies 'with Chinese labels' as a required prompt pattern for diagrams/concept art. This forces a specific language output without user opt-in, which matches the natural-language policy category for language or locale constraints.
Content: No source excerpt is available for this finding.