video-auto-generator

• Outcome: Review
• Latest audit: Jul 1, 2026 · 1:15 PM UTC
• Version: 1.0.1

Overview

The skill is not clearly malicious, but its runnable video pipeline does materially different work than advertised and needs user review before installation.

Install only if you are comfortable reviewing and controlling the scripts before use. Expect local file creation, ffmpeg/edge-tts execution, possible package installs, and optional external API calls; do not use sensitive scripts or private source material with third-party providers unless you explicitly intend to share it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 91% confidence

Finding

This code builds a Python program as an f-string and passes user-influenced file paths into that code for execution via python -c. Because img_path and seg_path are embedded directly inside a generated code string, crafted path contents containing quotes or Python syntax could break out of the string literal and lead to arbitrary Python code execution.

Content

Scanner excerpt · scripts/full_pipeline.py (reported line 215)May include surrounding context.

python

sys.exit(r.returncode)
"""
            ]
            result = subprocess.run(cmd, capture_output=True)
            if result.returncode == 0:
                size = os.path.getsize(seg_path)
                print(f"      ✅ seg_{i:02d} ({dur}s)")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill documents file read/write and shell-execution capabilities (e.g., ffmpeg, edge-tts, pip, winget, Python scripts) but does not declare corresponding permissions. This creates a transparency and consent problem: users or the hosting platform may not realize the skill can execute commands and write outputs to disk, increasing the risk of unintended system changes or unsafe command use.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

A description-behavior mismatch is a real security issue because it undermines informed consent and trust boundaries. If the actual implementation generates hardcoded promotional content unrelated to the user's request and skips promised steps like subtitle generation or genuine AI scripting, users may unknowingly execute a marketing pipeline rather than the advertised video-generation workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example trigger phrases are broad, common-user expressions like '生成视频' and '制作视频', which can easily match ordinary conversation and invoke the skill unintentionally. In a skill that performs automated content generation and media-processing workflows, accidental activation can lead to unreviewed file creation, resource consumption, and unexpected downstream actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README advertises a fully automatic workflow that generates scripts, audio, subtitles, images, and final video output, but it does not warn users that the skill creates multiple files and may invoke external tooling like ffmpeg and edge-tts. In an agent environment, omitting these operational and side-effect disclosures increases the risk of users triggering substantial filesystem changes or automated processing without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Overly broad trigger phrases increase the chance that the skill activates on casual conversation and initiates shell/file operations unexpectedly. In this skill context, accidental activation is more dangerous because the documented workflow includes package installation, media processing, and writing outputs to disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill says outputs are saved to a Desktop directory but does not clearly warn users about disk writes, file naming, retention, or overwrite behavior. Silent writes to common user locations can leak sensitive topic names, clutter filesystems, or overwrite existing content if naming is predictable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation includes sending prompts/content to a third-party API without a clear privacy warning or user consent mechanism. Because video-generation inputs may contain proprietary scripts, documents, or personal media, undisclosed external transmission can expose sensitive data to external processors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The HeyGen example transmits script content to an external video-generation provider without warning about data sharing, retention, or vendor processing. In this context the transmitted text may include sensitive marketing plans, internal documents, or personal content, making undisclosed transfer a meaningful privacy risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This is a genuine external transmission point: content is posted to Kling AI over the network. External transmission is not inherently malicious, but without consent, minimization, and disclosure it becomes a privacy and compliance risk, especially if user prompts or source materials contain confidential information.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

md

import requests

def test_kling_api():
    api_url = "https://api.klingai.com/v3/images/generations"
    headers = {"Authorization": f"Bearer {$env:KLING_API_KEY}"}
    payload = {
        "model": "kling-3.0",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This code example sends content to the HeyGen API, which is a real outbound data flow to a third party. In a video-generation skill, scripts and avatar parameters may reflect sensitive business or personal information, so undisclosed transmission raises privacy and policy concerns even if the feature is legitimate.

Content

Scanner excerpt · SKILL.md (reported line 436)May include surrounding context.

md

script: 配音文案
        avatar_id: 虚拟主播ID
    """
    api_url = "https://api.heygen.com/v2/video/generate"
    payload = {
        "video_inputs": [{
            "character": {

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 94% confidence

Finding

This is the strongest confirmed issue in the file: path data is injected into dynamically generated Python source code and then executed. In the skill context, topic-derived output directories influence filenames, making the generated code path more dangerous because a crafted topic could poison path names and trigger arbitrary code execution during video rendering.

Content

Scanner excerpt · scripts/full_pipeline.py (reported line 215)May include surrounding context.

python

sys.exit(r.returncode)
"""
            ]
            result = subprocess.run(cmd, capture_output=True)
            if result.returncode == 0:
                size = os.path.getsize(seg_path)
                print(f"      ✅ seg_{i:02d} ({dur}s)")