T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/upload_bilibili.py:10- Finding
Hard-Coded Bilibili Credential File Is Read at Module Import Time
- Content
View full analysis
- Remediation
View remediation
Security audit
VoxCPM中文配音
Security checks for vulnerabilities and agentic risk
Overview
The core dubbing workflow is plausible, but the package includes under-scoped external data sharing and a separate authenticated Bilibili upload script that needs careful review before installation.
Review this before installing. Use it only with videos and voice samples you are allowed to process, assume transcripts and at least one video frame may be sent to the configured translation/vision API, pin and review dependencies, and remove or isolate scripts/upload_bilibili.py unless you explicitly want authenticated Bilibili publishing from this skill.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:69- Finding
Unpinned Dependencies and Mutable VoxCPM Source Are Executed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (47)
Tainted flow: 'vision_url' from os.environ.get (line 122, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 97% confidence
- Finding
The vision API endpoint is environment/configurable and the code sends a base64-encoded video frame plus an Authorization bearer token to that URL. If an attacker controls VISION_API_URL or related config, they can exfiltrate sensitive media content and API credentials to an arbitrary server, which is especially dangerous in an agent skill handling user videos.
- Content
python vision_model = config.get('vision', {}).get('model', 'Qwen/Qwen2.5-VL-72B-Instruct') try: resp = requests.post( vision_url, headers={"Authorization": f"Bearer {translate_key}", "Content-Type": "application/json"}, json={
Tainted flow: 'api_url' from os.environ.get (line 214, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 98% confidence
- Finding
The translation endpoint is configurable from the environment and receives transcribed user content along with a bearer token. A malicious or misconfigured TRANSLATE_API_URL can redirect potentially sensitive transcript data and credentials to an attacker-controlled endpoint, creating both privacy leakage and credential exfiltration.
- Content
python } try: resp = requests.post(api_url, headers=headers, json=data, timeout=60) result = resp.json() if 'choices' in result:
Tainted flow: 'api_url' from os.environ.get (line 214, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 98% confidence
- Finding
The single-sentence fallback path repeats the same unsafe outbound behavior, so even if batch translation logic fails, the code still transmits user text and API credentials to a configurable endpoint. This makes exfiltration resilient across multiple execution paths and increases the reliability of abuse.
- Content
python for text in batch: for _ in range(3): try: resp = requests.post( api_url, headers={"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"}, json={
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented as a dubbing/localization tool, yet the documentation reveals an additional upload-to-Bilibili capability and use of local platform credentials and submission metadata. Hidden or secondary publishing behavior is dangerous because it can cause unintended data exfiltration, account misuse, or public release of content outside the user's expected workflow.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a dubbing/localization tool, yet the documentation reveals an additional upload-to-Bilibili capability and use of local platform credentials and submission metadata. Hidden or secondary publishing behavior is dangerous because it can cause unintended data exfiltration, account misuse, or public release of content outside the user's expected workflow.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script loads Bilibili account credentials from disk and performs a full authenticated upload to a public video platform, which goes beyond a narrowly described dubbing/translation function into external publishing. In an agent-skill context, this creates a high-risk capability for unauthorized posting, data exfiltration of generated content to third-party services, and account misuse if invoked without explicit user consent and scope disclosure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The title and core positioning repeatedly specify the skill as a Chinese dubbing skill, with no indication that users may choose another language or that the locale restriction is required for compliance or another documented reason. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill advertises capabilities that involve environment access, filesystem reads/writes, networking, and shell execution, but it does not declare any explicit tool scope or permission boundaries. This is dangerous because a host agent may grant broader access than users expect, making sensitive file access, command execution, and outbound transmission insufficiently constrained.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The activation guidance is broad enough that the skill may be invoked for many loosely related translation or localization requests. Overbroad triggers are risky because they can cause automatic execution of networked and file-modifying workflows in situations where the user did not clearly request dubbing or external processing.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file repeatedly positions the skill as producing Chinese dubbing by default, including in the name and description, without offering a language-selection option or documenting that Chinese-only behavior is an intentional user choice. This can violate language/locale policy expectations when a skill imposes a specific output language absent opt-in.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
The skill defines external API endpoints for translation and subtitle-detection vision tasks, which implies transmission of user-derived content to third-party services. In the context of video processing, this can expose transcripts, frames, subtitles, or metadata from potentially sensitive media.
- Content
md endpoints: - name: TRANSLATE_API_URL description: 翻译API端点 default: https://api.siliconflow.cn/v1/chat/completions - name: VISION_API_URL description: 硬字幕检测API端点（支持Vision模型） default: https://api.siliconflow.cn/v1/chat/completions
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
A second externally configured API endpoint further confirms off-host data transfer as part of the workflow. Even if operationally necessary, remote vision processing increases privacy and compliance risk when videos may contain personal, proprietary, or confidential material.
- Content
md default: https://api.siliconflow.cn/v1/chat/completions - name: VISION_API_URL description: 硬字幕检测API端点（支持Vision模型） default: https://api.siliconflow.cn/v1/chat/completions paths: - name: WORK_DIR description: 工作目录
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill states that external API calls happen automatically and that output files are generated, but it does not prominently warn users that media/transcript data will leave the system and local files will be modified. Lack of clear notice undermines informed consent and increases the risk of privacy violations or destructive processing in sensitive environments.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The example configuration includes a remote translation API URL and API key, indicating that transcript or text content will be sent to an outside provider. This is security-relevant because users may assume processing is local unless outbound transmission is clearly disclosed and consented to.
- Content
md "voxcpm_dir": "./VoxCPM", "ffmpeg_path": "ffmpeg", "translate": { "api_url": "https://api.siliconflow.cn/v1/chat/completions", "api_key": "YOUR_API_KEY", "model": "tencent/Hunyuan-MT-7B" },
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The example vision configuration shows use of a remote multimodal model endpoint, which may require sending sampled video frames or subtitle images externally. In this context, that can disclose visual content from user videos, making the data-transmission risk material even if the feature is optional.
- Content
md "model": "tencent/Hunyuan-MT-7B" }, "vision": { "api_url": "https://api.siliconflow.cn/v1/chat/completions", "model": "Qwen/Qwen2.5-VL-72B-Instruct" }, "tts": {
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Including an independent Bilibili upload capability inside a dubbing-focused skill expands the effective attack surface beyond what the skill name and summary suggest. Users invoking a media-processing skill may not anticipate account-linked publication behavior, increasing the risk of unintended uploads or credential exposure.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation exposes a platform-upload feature that is disproportionate to the declared dubbing purpose. Capability creep of this kind is dangerous because it mixes local media processing with external account actions, which can lead to accidental publication or abuse of locally stored login state.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill claims 'local run, data safe' while also depending on external translation and vision APIs, meaning user video-derived content may be transmitted off-host. Misrepresenting data locality and safety can cause users to share sensitive media under false assumptions about privacy and processing boundaries.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The configuration sends translation content to an external API endpoint, which can expose user-provided text, subtitles, or derived transcript data to a third-party service. In a video dubbing skill, this is materially relevant because uploaded media often contains sensitive spoken content, and the config provides no indication of consent, data minimization, or local-only alternatives.
- Content
json "voxcpm_dir": "./VoxCPM", "ffmpeg_path": "ffmpeg", "translate": { "api_url": "https://api.siliconflow.cn/v1/chat/completions", "api_key": "YOUR_API_KEY_HERE", "model": "tencent/Hunyuan-MT-7B" },
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
The vision model endpoint implies that video frames or subtitle-detection inputs may be transmitted to an external API, potentially exposing sensitive visual content to a remote provider. Given this skill's purpose of processing user videos, the context makes the issue more significant because private or copyrighted media could be sent off-device without explicit safeguards shown in the config.
- Content
json "model": "tencent/Hunyuan-MT-7B" }, "vision": { "api_url": "https://api.siliconflow.cn/v1/chat/completions", "model": "Qwen/Qwen2.5-VL-72B-Instruct" }, "whisper": {
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language policy check applies to all file types, including config files. Setting "language": "en" forces a specific language/locale behavior with no opt-in, fallback, or documented reason, which can violate language-choice policy expectations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest repeatedly specifies that the skill performs '中文配音' and '一键中文配音', which indicates a fixed Chinese-language output. Under the policy, forcing a specific language without an explicit user choice or documented justification is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README explicitly instructs users to record or supply a reference voice sample for TTS cloning without any warning about consent, privacy, retention, or lawful use of biometric voice data. In a dubbing skill, this omission increases the risk of unauthorized voice cloning, misuse of someone else’s voice, and improper handling of sensitive personal data.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The header comment lists 'BGM自动循环（交叉淡入淡出）' and '自动淡入淡出' as features, but the actual filter only applies volume adjustment and amix at L75-L78. No afade/acrossfade-style filter is present, so the documented behavior actively overstates what the code does.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "ffprobe", "-v", "error", "-show_entries", "format=duration", "-of", "json", video_path ] result = subprocess.run(cmd, capture_output=True, text=True) data = json.loads(result.stdout) return float(data['format']['duration'])
Static analysis
No suspicious patterns detected.