Security audit

CreatOK Recreate Video

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its TikTok recreation purpose, but unsafe run ID path handling can write saved analysis files outside its intended artifact folder.

Review this before installing if you will run it in a workspace with sensitive files. It sends TikTok URLs to CreatOK and saves returned analysis locally, which is expected, but the current run ID handling should be fixed or constrained so artifact writes cannot leave the skill's .artifacts directory.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: lib/artifacts.js:36
Finding: Path Traversal Through Unvalidated Run ID Allows Writes Outside the Artifact Directory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is presented as a creative TikTok recreation workflow, but its documented behavior includes local artifact creation and file writing that are not clearly surfaced in the top-level purpose. This mismatch can mislead users and reviewers about data handling, creating risk that reference URLs, analysis payloads, or user product information are written to disk without informed expectation or adequate controls.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares network/API-key requirements and implies file/artifact handling, but it does not explicitly constrain tool usage with a permissions or allowed-tools section. That creates unnecessary ambiguity about what the agent may access at runtime, increasing the chance of over-broad network or environment access beyond what is needed for the workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The function sends the provided TikTok URL to an external client via client.analyze(tiktokUrl) and then writes returned video metadata and transcript content to local artifact files. In this file, there is no confirmation prompt, print/log message, or explanatory comment/docstring disclosing that remote processing and persistent storage of potentially sensitive content will occur.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code writes a JSON artifact containing the input TikTok URL and the full analysis result to outputs/recreate_source.json. In this file there is no confirmation prompt, user-facing log/print, or explanatory comment/docstring warning that user-provided data and derived results will be persisted to disk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The handoff guidance uses broad trigger phrases like 'rewrite this for my product' or 'turn this into a video' without requiring stronger confirmation that another skill is actually appropriate. In a multi-skill agent, this can cause unintended routing, context carryover, or premature invocation of a different skill based on ambiguous user language, which may lead to incorrect actions or disclosure of prior context to the wrong downstream skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The instruction says the final user-facing response should match the user's input language, but otherwise defaults to English. This creates a language policy constraint without explicit user opt-in, which can be a natural-language policy issue under the locale/language rule.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The manifest frames the skill as recreating or remixing a TikTok reference video into a new version, which suggests media-processing behavior. This file instead pulls a CREATOK_API_KEY from the environment and prepares a remote service configuration, introducing credential handling and implied external service use that are not justified by the stated purpose alone.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.