Google vertex video adc

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:30 AM UTC
• Version: 1.0.0

Overview

This skill appears intended for Google Vertex AI video generation, but it needs review because it silently leaves raw API responses in predictable temporary files.

Install only if you are comfortable sending prompts and optional images to Google Cloud Vertex AI using your project credentials. Review or patch the script before use so raw response JSON is not written to predictable shared temp files unless explicitly requested for debugging.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/video_harness.py:220

Finding

Predictable Temporary Files Permit Symlink Overwrites and Response Data Exposure

Content

View full analysis

Vulnerability Details

File Location: scripts/video_harness.py, lines 220–225, 258–263, and 272–277
Vulnerability Type: Predictable and insecure temporary-file handling
Risk Level: Medium

The script writes API responses to fixed filenames in the shared system temporary directory:

python

# Save response for debugging under system temp dir
temp_dir = tempfile.gettempdir()
resp_path = os.path.join(temp_dir, 'vertex_video_response.json')
try:
    with open(resp_path, 'w', encoding='utf-8') as f:
        f.write(out)
except Exception:
    pass

python

# Save intermediate poll log to system temp dir
poll_path = os.path.join(temp_dir, 'vertex_video_operation_poll.json')
try:
    with open(poll_path, 'w', encoding='utf-8') as f:
        f.write(out)
except Exception:
    pass

python

final_path = os.path.join(temp_dir, 'vertex_video_operation_final.json')
try:
    with open(final_path, 'w', encoding='utf-8') as f:
        f.write(json.dumps(pj))
except Exception:
    pass

Technical Analysis

tempfile.gettempdir() commonly returns a shared directory such as /tmp. The files use constant, globally predictable names and are created with ordinary open(..., 'w').

This operation:

• Follows symbolic links.
• Truncates an existing target before writing.
• Does not atomically reserve a unique pathname.
• Does not explicitly enforce owner-only permissions.
• Allows concurrent Skill runs to overwrite each other's response files.
• Leaves API responses and potentially base64-encoded video content behind after execution.

A local attacker who can create entries in the shared temporary directory may pre-create one of these predictable paths as a symbolic link. When the Skill runs under another account, Python may follow the link and overwrite a file writable by that victim account. Platform protections such as Linux protected-symlink settings may reduce ...[truncated 2120 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove response-debug file creation unless the user explicitly enables a debugging option.

2. Use a per-execution private temporary directory:

   python

   with tempfile.TemporaryDirectory(prefix="vertex_video_") as temp_dir:
       resp_path = os.path.join(temp_dir, "response.json")
   

3. If files must survive execution, create them atomically with tempfile.NamedTemporaryFile(delete=False) or mkstemp() rather than constructing predictable names.

4. Enforce owner-only permissions such as 0600.

5. Do not follow symbolic links when opening an existing path. Where supported, use os.open() with O_CREAT | O_EXCL | O_NOFOLLOW.

6. Give each invocation and polling record a unique filename to prevent cross-run collisions.

7. Delete temporary response files in a finally block when they are no longer needed.

8. Avoid storing full response bodies when minimal metadata is sufficient. In particular, omit or redact generated base64 media content and sensitive error details from debug files.

9. Do not silently suppress all cleanup and write exceptions; report sanitized diagnostic errors so insecure or failed file handling can be detected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README documents sending prompts and optional reference images to Google Cloud Vertex AI but does not clearly warn users that their content, and potentially account/project-context metadata, will be transmitted to a third-party cloud service. In an agent skill context, this omission is security-relevant because users may supply sensitive prompts or local images under the assumption processing is local or privacy-neutral, leading to unintended data disclosure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill invokes shell commands, reads environment variables, and reads/writes local files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates a transparency and least-privilege gap: a host agent may permit broader capabilities than users expect, and the combination of shell access plus Google ADC credentials increases the risk of unintended command execution or credential misuse if the skill is invoked in an unsafe context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Generating videos with Vertex AI requires authentication and HTTP requests, but this implementation accomplishes both by spawning external programs rather than using in-process libraries. Subprocess execution is a broader capability that increases environmental dependence and execution surface beyond what the manifest's purpose implies.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_harness.py (reported line 22)May include surrounding context.

python

cmd = ['gcloud', 'auth', 'application-default', 'print-access-token']
    else:
        cmd = ['gcloud', 'auth', 'print-access-token']
    proc = subprocess.run(cmd, capture_output=True, text=True)
    if proc.returncode != 0:
        print(json.dumps({
            "ok": False,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_harness.py (reported line 39)May include surrounding context.

python

cmd = ['gcloud', 'auth', 'application-default', 'print-access-token']
    else:
        cmd = ['gcloud', 'auth', 'print-access-token']
    proc = subprocess.run(cmd, capture_output=True, text=True)
    if proc.returncode != 0:
        print(json.dumps({
            "ok": False,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The harness writes full API responses and polling results to predictable files in the system temp directory. Those responses may contain prompts, operation metadata, error details, and base64-encoded video content, creating unintended local data exposure and residual sensitive artifacts beyond the advertised video-generation purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Writing raw API responses to system temp files without user disclosure can leak sensitive request/response data to other local users, backup systems, or later processes on the same host. Because the filename is static and the temp location is shared, the behavior increases the chance of unauthorized access and unintended retention.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.