视频自动生成器

• Outcome: Review
• Latest audit: Jun 29, 2026 · 9:19 PM UTC
• Version: 1.1.0

Overview

This video-generation skill uses expected media tools, but it needs Review because it can run local commands, write to Desktop, send text to external services, and includes a risky rendering path plus hardcoded promotional output.

Review before installing. Use it only in a workspace where local command execution, ffmpeg processing, Desktop or chosen-folder file creation, and third-party TTS/video API calls are acceptable. Do not process sensitive scripts or private business content unless you are comfortable sending narration or prompts to external providers. Prefer an explicit output directory, inspect generated content for hardcoded promotional text, and avoid passing unusual characters in output paths until the python -c rendering step is fixed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

sys.exit(r.returncode)
"""
            ]
            result = subprocess.run(cmd, capture_output=True)
            if result.returncode == 0:
                size = os.path.getsize(seg_path)
                print(f"      ✅ seg_{i:02d} ({dur}s)")

• Confidence: 90% confidence
• Finding: This code launches `python -c` with a dynamically constructed Python source string containing file paths derived from user-controlled output locations. While it avoids a shell, embedding paths directly into generated code can break quoting and can enable code-injection-style execution if crafted path content escapes the Python string literal. In the context of an agent skill that may operate on user-provided topics/output paths, this makes the pattern more dangerous than a normal ffmpeg wrapper.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documents shell execution, local file reads/writes, and automated media generation, but declares no permissions. That creates a trust and containment gap: a user or host may invoke a skill believing it is low-risk while it can install packages, run ffmpeg/edge-tts, and write outputs to disk. In an agent environment, undeclared capabilities materially increase the chance of unexpected system modification or unsafe invocation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documented behavior does not match the described purpose: the finding indicates hardcoded promotional content generation, local artifact creation, and unimplemented advertised features such as true image-to-video and subtitle generation. This is dangerous because users may provide inputs under false assumptions about what will be produced and where data will go, while the skill performs different actions and writes multiple files locally. Security review relies on accurate declarations, so behavior mismatch undermines informed consent and safe policy enforcement.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The README shows a very broad natural-language trigger example for video generation that overlaps with common user requests such as '帮我生成一个视频'. In a voice or chat-driven agent platform, overly generic trigger phrasing can cause accidental invocation of a high-impact automation skill, leading to unintended content generation, file creation, and downstream tool execution.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README describes a fully automated pipeline that generates scripts, audio, subtitles, images, and a final video using external tools and services, but it does not warn users that files will be created or that external components like edge-tts/ffmpeg may be invoked. This can lead to silent local side effects, unexpected network use, storage consumption, and execution of potentially risky media-processing steps without informed user consent.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger phrases are extremely broad and likely to match common user requests such as '生成视频' or '做个短视频'. In a skill that can run shell commands, install tools, call external APIs, and write files, overbroad triggering raises the risk of accidental activation and unintended side effects without the user realizing this specific automation skill has been invoked.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly states it will create output files on the Desktop, but does not provide a clear user-facing warning or consent step for local filesystem writes. Automatic writes to a prominent user directory can expose sensitive filenames/content, clutter the system, or overwrite expectations in environments where users assumed a dry-run or in-memory workflow.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation directs users to configure API keys and use third-party services, but does not give a user-facing warning that prompts, media, or metadata may be transmitted externally. In a video-generation context, uploaded scripts, images, or voice content may contain sensitive or proprietary material, so lack of disclosure meaningfully increases privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill forwards user-provided text to the edge-tts engine without any visible consent, warning, or data-handling disclosure. In an agent context, users may supply sensitive or proprietary content for narration, so silent transmission to an external service creates a real privacy and data-exposure risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The pipeline sends generated voice text to `edge-tts`, which may involve transmission to an external network service, without explicit user notice or consent. If users provide sensitive topics or scripts, this can expose private or proprietary content; in an automation skill, silent outbound data transfer is materially more risky because users may assume local-only processing.

External Transmission

Medium

• Category: Data Exfiltration

Content

import requests

def test_kling_api():
    api_url = "https://api.klingai.com/v3/images/generations"
    headers = {"Authorization": f"Bearer {$env:KLING_API_KEY}"}
    payload = {
        "model": "kling-3.0",

• Confidence: 91% confidence
• Finding: This code example posts data to Kling AI’s external API, which constitutes outbound transmission of prompts and potentially user-derived content. External transmission is not inherently malicious, but it is security-relevant here because the skill markets broad automated generation workflows without strong disclosure or minimization of what content leaves the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

script: 配音文案
        avatar_id: 虚拟主播ID
    """
    api_url = "https://api.heygen.com/v2/video/generate"
    payload = {
        "video_inputs": [{
            "character": {

• Confidence: 89% confidence
• Finding: The HeyGen integration example sends script content to an external video-generation provider, creating the same privacy and third-party exposure concerns as other cloud API calls. In this skill context, scripts may embed business plans, personal content, or unpublished marketing material, making silent or under-disclosed transmission materially risky.

Unvalidated Output Injection

High

• Category: Output Handling

Content

sys.exit(r.returncode)
"""
            ]
            result = subprocess.run(cmd, capture_output=True)
            if result.returncode == 0:
                size = os.path.getsize(seg_path)
                print(f"      ✅ seg_{i:02d} ({dur}s)")

• Confidence: 92% confidence
• Finding: This finding is valid because untrusted path/content is interpolated into a generated Python snippet that is then executed via `python -c`. That creates a code-injection surface analogous to output/code injection even without a shell; a crafted path containing quote-breaking characters could alter the embedded Python code and execute unintended commands.

Static analysis

No suspicious patterns detected.