explainer

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 3:48 AM UTC
• Version: 1.2.1

Overview

This is a coherent video-generation skill with disclosed Ofox API use and user approval gates; the main caution is optional unpinned npx dependency-install guidance.

Before installing, confirm you trust Ofox and the ofoxai dependency source, set OFOX_API_KEY only if you intend to use the service, require the dry-run cost table and explicit approval before paid generation, and prefer pinned or marketplace-verified installation of ofox-video-core instead of copy-pasting unpinned npx commands.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The changelog includes an `npx skills add ofoxai/skills --skill ofox-video-core` command without a pinned package version. Even though the text explicitly tells the caller to relay the command rather than run it, an unpinned `npx` install still trusts the latest published package at execution time, which creates a supply-chain risk if the package is changed or compromised.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The file references `npx ofox-skills` as a distribution route without a pinned version. Referencing unpinned `npx` executables in operational guidance can lead users or agents to fetch and execute whatever version is current at the time, exposing them to package hijack or malicious updates.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This changelog entry again references `npx ofox-skills` without pinning, preserving the same supply-chain exposure in recovery guidance. In skill ecosystems, users may copy-paste such commands directly, so documentation alone can materially influence unsafe execution.

Unbounded Output

Medium

• Category: Output Handling

Content

Measured: 22.49s of actual speaking plus 5.64s of internal silence in **7
  pauses — exactly the script's 7 sentence boundaries**, ~0.7s each. Speaking
  rate 3.56 w/s. The formula predicts 27.4s for that script; the delivered
  span was 28.13s, with 1.39s of tail and no truncation. **90 words in 8
  sentences needs 30.2s of span and does not fit a 30-second clip.**
- ⚠️ **Count sentences, not only words.** Two 80-word scripts can differ by
  several seconds, and short punchy sentences are the *slower* ones. When a

• Confidence: 60% confidence
• Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The changelog states that "The spoken language follows the source's language, never asked," which is a natural-language locale policy constraint applied automatically. This removes user choice over language/locale and matches the rule's example of forcing a specific language without opt-in.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The initial release notes instruct callers to install `ofox-video-core` via `npx ofox-skills`, again without version pinning. Because this is installation guidance for a dependency required by the skill, it increases the chance of executing an unexpected or malicious package version.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The statement that `npx ofox-skills` installs every skill in the repo describes an overbroad installation path and still relies on an unpinned `npx` tool. This compounds supply-chain risk with unnecessary expansion of installed functionality, increasing the blast radius if the package or repository contents are compromised.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The skill instructs users to run `npx ofox-skills` without pinning an exact package version. Unpinned `npx` execution fetches and runs whatever the latest published package is at install time, creating a supply-chain risk if the package is compromised, typosquatted, or updated with unsafe behavior.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The markdown states spoken language is a 'never-ask' axis and that it 'follows the source' automatically. This imposes a language/locale choice by default rather than offering the user an opt-in or explicit language selection, which conflicts with the policy against forcing a specific language without user choice.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The command `npx skills add ofoxai/skills --skill ofox-video-core` runs an unpinned package resolver path and may execute unexpected code from the npm ecosystem or newly published package versions. Because this instruction is specifically for installing a missing dependency, the user is being directed to execute remote code outside the working directory, increasing the blast radius of a supply-chain compromise.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: This is another unpinned `npx ofox-skills` invocation, carrying the same remote-code-execution and supply-chain exposure as the earlier occurrence. The surrounding text even frames it as a convenience wrapper that auto-answers prompts, which can make users less cautious and more likely to execute it without review.

Static analysis

No suspicious patterns detected.