Ai Video Script Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:44 AM UTC
• Version: 1.0.2

Overview

The skill appears to generate video scripts as described, but it always saves generated topics and scripts to local files without a clear opt-out or deletion guidance.

Review before installing if you handle confidential topics, client campaigns, or unpublished content. Expect generated scripts and a running topic/style history to be saved under ~/video-scripts on every run unless the code is changed; delete that directory manually if you do not want the retained history.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared purpose centers on script generation, but the skill also performs undeclared local persistence and overstates its memory/optimization behavior. This mismatch is risky because users may provide content under the assumption of transient processing, while the skill retains data locally without sufficiently prominent disclosure in the primary metadata.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documents persistent writes to `~/video-scripts/` but does not declare any tool scope or permissions for file writing. Undeclared write capability weakens user consent and platform enforcement, and in this context it can silently persist user-generated content and preference data on disk.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad, generic terms like '生成脚本' and '视频脚本', which are likely to match ordinary conversation and invoke the skill unexpectedly. In a skill that can write files and retain preferences, accidental activation increases the chance of unintended data collection or persistence.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The skill description and examples are entirely Chinese and target Chinese platforms, but there is no statement that the skill is Chinese-only or that users may choose another language. This can be interpreted as forcing a locale/language behavior without explicit opt-in or documented justification.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly states that user scripts, history, and preferences are saved persistently, but it does not provide an adequate privacy warning, consent flow, or retention/deletion guidance. Because the stored content may include unpublished creative work and user preference profiles, silent retention creates privacy and data-governance risk.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module description and generated content templates are written entirely in Chinese, and the interface provides no option for users to select another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly documented and justified.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill persists generated scripts and a running history of user topics, styles, hooks, and timestamps to local disk under the user's home directory. This creates an unintended data retention surface: sensitive or proprietary topics may be stored without explicit consent, and other local users, backup systems, or later processes could access that history.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The condition `if args.output or True` forces file writes on every execution, defeating any user expectation that persistence is optional. In a skill context, silent default writes can expose sensitive prompts or business ideas to disk even when a user only expected transient generation output.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Writing files by default without explicit upfront warning or consent creates a privacy and data-governance risk, especially because topics may contain confidential campaign plans, customer information, or unreleased content. The danger is amplified here because the tool also maintains ongoing history, increasing the persistence and discoverability of user data.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: The inline comment describes updating memory as a simplified memory mechanism, implying preference retention aligned with the skill description. In reality, the code appends a historical record for each generated script including topic, platform, hook, and timestamp, which is broader than just storing user writing preferences.

Static analysis

No suspicious patterns detected.