ofox-video-core

• Outcome: Pass
• Latest audit: Sep 22, 2026 · 8:57 AM UTC
• Version: 2.0.3

Overview

This is a disclosed Ofox video API helper that uses an API key and paid requests with visible cost and approval safeguards, with no hidden persistence or destructive behavior found.

Install only if you intend to use the Ofox video API. Keep OFOX_API_KEY private, check that OFOX_API_BASE_URL is unset or points where you expect, require a dry-run cost table and explicit yes before any --approved run, and remember that local frame files passed to the script may be encoded into requests sent to Ofox.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (113)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · CHANGELOG.md (reported line 2008)May include surrounding context.

md

that estimate is printed five lines before `curl -X POST`, so by the time an
agent could relay it, the job existed and was billable. There was no
`--dry-run` anywhere in the script. Following the docs literally meant billing
someone without warning.

- **`--dry-run` on `generate`, `batch` and `chain`.** Parses arguments,
  validates every parameter against the model, resolves the upstream, builds

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description captures part of the script's core behavior—creating Ofox video jobs, polling them, downloading outputs, and reporting costs—but it materially understates the breadth of the code. The code is not just a thin shared execution layer for scenario skills; it exposes a substantial standalone CLI with many subcommands unrelated to the narrowly declared purpose, including local media-processing tools that perform no API call at all. These capabilities are significant, not merely supportive implementation details, because they add independent functionality and local resource usage (ffmpeg/ffprobe, filesystem manipulation, image extraction, audio muxing, contact-sheet generation). Therefore the description does not accurately represent what the supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description presents this skill as the execution layer for Ofox video generation: submit jobs, poll them, download the resulting MP4, and report cost. The supplied code chunk is a maintenance/reference script for regenerating offline fallback snapshots from public API endpoints. Its primary purpose is materially different from the declared purpose. While it is related to Ofox and video models, it only fetches model metadata and pricing catalog data and writes JSON snapshot files; it does not implement the core behavior described for the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for a production/shared library skill that interacts with the Ofox API to submit jobs, poll them, download results, and report billing. The supplied code chunk is instead a regression/approval test script for ofox-video.sh. Its purpose is to verify that certain subcommands require --approved, that ungated commands remain usable, and that approval forwarding works in batch/chain modes. It explicitly avoids real API use by setting the base URL to an unroutable loopback address and uses placeholder credentials. This is a materially different primary purpose and capability set from the declared description, so it is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for a production library skill that interfaces with Ofox end-to-end: create job, poll, download result, and report cost. The supplied code chunk is instead a Bash test script under references/test that exercises another script's aspect-ratio logic in dry-run mode. It seeds cached model data, sets placeholder environment values, inspects generated payloads and NOTE messages, and optionally checks the live models catalog. This is a materially different purpose from the declared behavior. While it is related to the broader Ofox domain, the actual code neither performs the library workflow nor exposes the stated capabilities, so the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description says this skill is the shared execution layer for the Ofox video API itself: submit jobs, poll for completion, download MP4s, and report actual cost. The supplied code chunk does not implement that behavior; it is a reference test script for a separate shell program (ofox-video.sh). Its primary purpose is QA of CLI control flow and safety properties, including batch validation, early abort on failed takes, warnings about fixed seeds, estimate display, help text, and a local contact-sheet feature using ffmpeg. While this is related to the broader Ofox tooling, it is materially different from the declared library behavior and includes an undeclared local media-processing/testing capability. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description says this skill is the shared execution layer for the Ofox API itself: submitting jobs, polling to completion, downloading MP4s, and reporting real cost. But the provided code chunk is not that execution layer; it is a regression/integration test script for another script. Its primary purpose is to validate CLI behavior around chaining shots and extracting final frames, including ffmpeg interactions and safety guards before billing. Although it references Ofox-related commands and uses an API key placeholder/base URL, it deliberately avoids real network use and does not itself create, poll, or download Ofox jobs. This is a material description-behavior mismatch because the actual code chunk is test infrastructure with additional undeclared local-media-processing behavior, not the described shared API library implementation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this skill is the shared execution layer that actually talks to the Ofox API to create jobs, poll them, download results, and report cost. The provided code chunk is instead a reference test script (references/test/concurrency.test.sh). Its primary purpose is QA/testing of another script (ofox-video.sh), including concurrency and failure-handling semantics. While the subject matter is related to Ofox video generation, this chunk does not itself implement the declared operational library behavior; it invokes/stubs another script and explicitly avoids billable network calls. That is a material description-versus-behavior mismatch for the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The description claims this skill is the shared execution layer for Ofox video generation operations. However, the actual code shown is references/test/create.test.sh, a test script intended to validate behavior of another script (ofox-video.sh). Its primary function is automated testing: setting environment variables, forcing an unroutable API base, invoking subcommands like create, batch, generate, chain, and check, and asserting expected output and exit codes. While these tests concern the same Ofox domain, the supplied code chunk itself does not implement the declared API workflow. Because the primary purpose of the provided code is materially different from the declared purpose, this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this skill is the shared execution layer for the Ofox video API, responsible for real API job submission, polling, downloading outputs, and reporting actual cost. The supplied code chunk is instead a test harness (references/test/dryrun.test.sh) focused on validating --dry-run behavior of a separate target script. It intentionally avoids network calls, injects a placeholder API key, points the API base to localhost port 1, and asserts expected CLI output and validation semantics. That is materially different from the declared primary purpose and capabilities. While it is related to the same broader project, this specific code chunk does not implement the described operational behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description claims this skill is the shared execution layer for interacting with the Ofox video API in production: creating jobs, polling them, downloading outputs, and reporting real cost. The provided code chunk is not that library implementation; it is a test script under references/test/ that validates security guards around another target script (ofox-video.sh). While the tests reference and exercise aspects of the intended library behavior, the code shown primarily performs regression/security testing with mocked curl calls and dry-run behavior, and explicitly states it cannot create a billable job. That is a materially different primary purpose from the declared description, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about a production library skill that interacts with the Ofox remote video API: creating jobs, polling them, downloading output, and reporting costs. The supplied code chunk does none of that. It is a Bash test script (references/test/localtools.test.sh) that exercises local subcommands on another script, using synthesized media and ffmpeg/ffprobe. Its primary purpose is validating frame-at and mux-audio behavior, error handling, and lack of network/API-key dependence. This is a materially different purpose and capability set from the declared Ofox API execution layer, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description says this skill is an execution layer for the Ofox video API, handling job creation, polling, download, and cost reporting. The actual code shown is not that library behavior; it is a test script (references/test/naming.test.sh) that validates internal helper functions related to output naming and metadata sidecars. It explicitly avoids network access, sets a placeholder API key, points the base URL at an unroutable local address, fabricates completed job responses, and drives download_result with a local file:// path. While the tested functions may belong to the broader Ofox library, this specific code chunk's primary purpose is testing local naming/download-result behavior, not performing the declared API integration. That is a material description-behavior mismatch for the supplied chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill is an execution-layer library for interacting with the Ofox video API: creating generation jobs, polling them, downloading finished videos, and reporting cost. The supplied code chunk does none of that. It is a Bash test script under references/test that exercises another target script and checks documentation content. Its primary purpose is QA/regression testing for keyless paths, pricing display, and documentation statements. That is a materially different function from the declared API job orchestration behavior, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description presents this skill as the operational shared execution layer for Ofox video generation. However, the provided code chunk is clearly a reference test script focused on pricing estimates and documentation assertions. Its primary behavior is QA/testing: setting a placeholder API key, toggling online/offline base URLs, querying catalog pricing, invoking another target script in ways intended to avoid real submissions, and checking stderr/stdout estimate formatting and snapshot fallback. Those behaviors are materially different from the declared core functions of job creation, polling, result download, and actual-cost reporting. While the test script is related to the same broader project, this chunk does not accurately represent the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared description is for the main Ofox video library skill that submits jobs, polls them, downloads MP4s, and reports costs. The supplied code chunk is instead a reference test script (provider.test.sh) aimed at validating the behavior of another script, ofox-video.sh. It sets up a fake environment, inspects printed JSON payloads, checks provider defaults/overrides, validates error handling and usage output, and only touches the network for a public providers lookup. Those behaviors are related to the Ofox integration, but this chunk’s primary purpose is testing provider-routing behavior, not performing the operational library actions described. Therefore the description does not accurately represent this specific code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description is for the main Ofox API execution library. However, the actual code chunk shown is specifically a test file (validation.test.sh) for validating another script's argument handling and model metadata behavior. Its primary purpose is QA/testing, not carrying out Ofox video generation workflow operations. While the tests reference the expected behavior of the underlying skill and are related to it, the supplied code itself does not match the declared operational description. Therefore this is a description-to-code mismatch for the provided chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

- **The script never reads a dotenv file.** `references/ofox-video.sh` resolves

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

- **The script never reads a dotenv file.** `references/ofox-video.sh` resolves

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

- **The script never reads a dotenv file.** `references/ofox-video.sh` resolves

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md

- **The script never reads a dotenv file.** `references/ofox-video.sh` resolves

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

- **The script never reads a dotenv file.** `references/ofox-video.sh` resolves

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

- **The script never reads a dotenv file.** `references/ofox-video.sh` resolves

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md

- **The script never reads a dotenv file.** `references/ofox-video.sh` resolves

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

md

- **The script never reads a dotenv file.** `references/ofox-video.sh` resolves

Static analysis

No suspicious patterns detected.