Security audit

Scene Video Generator

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent scene-video generation skill, with expected external API use, but users should protect API keys and avoid sending sensitive prompts or images to video providers.

Before installing, understand that prompts and reference images may be sent to whichever video provider you configure. Do not use private, regulated, or copyrighted material unless you are comfortable sharing it with that provider. Store API keys outside source control, restrict access to any config file containing them, and rotate keys if they are exposed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description says the skill accepts scene descriptions plus an optional digital-avatar speech component, implying it can generate videos with a digital human. However, the body of the skill documentation states this skill produces AI scene video only and directs all digital-avatar video generation to a separate digital-avatar skill. This is a direct mismatch between the advertised capability and the documented intended behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are very broad, including generic terms like '生成视频', 'AI视频', and 'text to video', which can cause the skill to activate on ordinary user requests outside the intended workflow. In an agent ecosystem, overbroad activation can misroute prompts and user-supplied media to external generation backends unexpectedly, increasing the risk of unintended data disclosure or policy bypass through incorrect tool selection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill describes sending prompts and reference images to third-party video-generation APIs but does not present a clear user-facing warning or consent notice about that external transfer. Because prompts and images may contain sensitive business, personal, or copyrighted material, omission of disclosure can lead to unintended exfiltration to external providers and weakens informed-consent and data-handling guarantees.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide instructs users to place API credentials, including a secret key, directly into JSON configuration examples without any warning about keeping secrets out of source control, restricting file permissions, or using environment variables/secret managers. In a skill intended to integrate multiple paid external backends, this increases the chance that users will store long-lived credentials in plaintext and accidentally commit or expose them, leading to account compromise and unauthorized API usage.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This file presents all instructions exclusively in Chinese and does not mention that the content is region-specific or provide an opt-in or alternative language path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown guide presents its content primarily in Chinese while requiring many prompt components and examples in English, such as the recommended subject descriptions and style keywords. Because the file does not state that English is optional or offer a language/locale choice, it effectively imposes a specific language preference on users.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.