Video Production

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:43 PM UTC
• Version: 1.0.0

Overview

The skill's core video workflow is coherent, but it includes an unattended cron retry job with hardcoded personal notifications plus unsafe local file and preview handling that users should review before installing.

Install only if you are comfortable auditing and disabling the quota watcher first, removing or replacing hardcoded notification recipients and personal paths, keeping provider API keys out of shared shell startup files, and using only trusted storyboard/feedback files until path validation and HTML escaping are fixed.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T06 · System Persistence

Error

• Location: SKILL.md:140

Finding

Persistent Unattended API Retry Through Cron

Content

View full analysis

/dev/null | grep -v quota_watcher; \ echo "*/30 * * * * /path/to/quota_watcher.sh >> /tmp/quota_watcher.log 2>&1") | crontab - ``` The scheduled script only removes the job after a successful run: ```bash # Remove the cron job (self-destruct) crontab -l | grep -v "quota_watcher" | crontab - echo "[$(date)] Cron removed. Done." ``` ### Technical Analysis The documented command installs a recurring task in the user's crontab. It executes every 30 minutes and survives the initiating terminal and user session. This persistence is not necessary for the Skill's core video-generation, preview, feedback, or assembly functions. A foreground retry process, bounded retry loop, or explicitly approved one-shot job would provide the required quota-recovery behavior without modifying persistent system scheduling. The watcher removes itself only when `apply_feedback.py` returns success. A quota response leaves the task active by design. Other errors also return a nonzero status without removing the task, meaning the cron daemon will continue invoking it every 30 minutes despite the comment stating that unexpected errors should not be retried forever. ### Attack Path 1. The user follows the quota-management instructions in `SKILL.md`. 2. The command installs a recurring cron entry. 3. Cron invokes `quota_watcher.sh` every 30 minutes without an active user session. 4. The script loads API credentials from the user's environment and invokes the paid video-generation workflow. 5. Quota failures or unexpected errors leave the scheduled entry installed. 6. The task continues making unattended attemp ...[truncated 462 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/quota_watcher.sh:35

Finding

Unsafe Crontab Filtering Can Delete Unrelated Scheduled Jobs

Content

View full analysis

/dev/null | grep -v quota_watcher; \ echo "*/30 * * * * /path/to/quota_watcher.sh >> /tmp/quota_watcher.log 2>&1") | crontab - ``` ### Technical Analysis The cleanup command does not identify the exact cron entry installed by this Skill. Instead, it removes every crontab line containing the substring `quota_watcher`. This can delete unrelated jobs whose executable path, comments, arguments, or log path contain the same text. The cleanup pipeline also does not verify that `crontab -l` succeeded before sending filtered output to `crontab -`. If enumeration fails and produces no usable output, the final command may install an empty crontab. The operation is neither atomic nor backed up, and it offers no recovery if unrelated entries are lost. The installation command has a similar issue: it removes all preexisting matching entries before appending the new one. ### Attack Path 1. The affected user already has one or more unrelated cron entries containing `quota_watcher`, or crontab enumeration fails. 2. The video-production watcher completes successfully and executes its cleanup pipeline. 3. `grep -v` removes all matching lines, not only the Skill's own entry. 4. The filtered or empty result replaces the user's complete crontab. 5. Unrelated scheduled processes stop running without a warning or restoration mechanism. A maliciously chosen existing cron line, path, or comment can also cause a legitimate scheduled task to be removed when the user installs or completes this Skill's watcher. ...[truncated 345 chars]

Remediation

View remediation

``` 2. Remove only the exact entry associated with that identifier rather than every line containing a generic substring. 3. Capture the existing crontab into a permission-restricted temporary file and verify that `crontab -l` succeeded before modifying it. 4. Abort without writing if enumeration, parsing, or filtering fails. 5. Create a backup before replacement and restore it if installation fails. 6. Prefer a scheduler interface that supports task identifiers and direct deletion. 7. Add shell error handling such as `set -euo pipefail`, while explicitly handling the expected “no crontab” case. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_preview.py:52

Finding

Storyboard Data Is Injected into Local HTML and JavaScript Without Escaping

Content

View full analysis

{scene['label']} {scene['id']} {scene.get('duration', 5)}s

{video_html}

Prompt: {scene['prompt'][:120]}{'…' if len(scene['prompt']) > 120 else ''}

✓ Approve ↺ Revise

""" ``` The project name is also inserted directly into markup: ```python {project_name} — Preview ``` ```python

🎬 {project_name}

``` ### Technical Analysis The generator treats storyboard fields as trusted HTML. Scene IDs are inserted into HTML attributes and inline JavaScript string literals. Labels, prompts, and the project name are inserted into HTML text contexts without escaping. An attacker-controlled scene ID containing quotes can terminate an `id` attribute or the JavaScript string passed to `onclick`. Labels, prompts, or project names containing HTML tags can inject elements or scripts into the generated document. Because th ...[truncated 1447 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/batch_generate.py:94

Finding

Unvalidated Storyboard Paths Permit Writes Outside the Project Directory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: dalle_generator.py:56

Finding

DALL-E Output Filename Allows Writes Outside the Assets Directory

Content

View full analysis

2 else None generate_frame(prompt, filename) ``` ### Technical Analysis The output filename is joined to `ASSETS_DIR` without validating whether it is absolute, contains traversal components, or has an approved extension. If `filename` is absolute, `pathlib` discards `ASSETS_DIR` and uses the absolute path. A relative value containing `../` can also escape the assets directory. PIL then saves the generated image to that path and may replace an existing writable image file. This issue is directly exploitable when another agent, workflow, or untrusted caller can control the output filename argument. ### Attack Path 1. An attacker or untrusted workflow supplies an absolute or traversing output filename. 2. The user runs `dalle_generator.py` with a valid OpenAI API key. 3. The image-generation request succeeds and returns image content. 4. `ASSETS_DIR / filename` resolves outside the intended assets directory. 5. PIL writes the image to the attacker-selected user-writable location, replacing an existing file where permitted. ### Impact Assessment The vulnerability allows creation or replacement of image files outside the intended output directory with the invoking user's filesystem privileges. The written content is generated image data, which limits direct payload control, but overwriting user-owned image assets or application data can still cause integrity and ava ...[truncated 19 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:161

Finding

Runtime Dependencies Are Installed Without Version or Integrity Pinning

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (38)

Tainted flow: 'headers' from os.getenv (line 28, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · dalle_generator.py (reported line 43)May include surrounding context.

python

print(f"🎨 Generating: {prompt[:60]}...")
        
        response = requests.post(url, headers=headers, json=payload)
        
        if response.status_code == 200:
            data = response.json()

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented behavior includes outbound notifications to a personal contact, cron manipulation, and operational retry automation that are outside the core stated purpose of video production. Hidden or weakly disclosed messaging and persistence features create a real exfiltration and unauthorized automation risk because project metadata or local system state may be transmitted or scheduled without adequate user awareness.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documented behavior includes outbound notifications to a personal contact, cron manipulation, and operational retry automation that are outside the core stated purpose of video production. Hidden or weakly disclosed messaging and persistence features create a real exfiltration and unauthorized automation risk because project metadata or local system state may be transmitted or scheduled without adequate user awareness.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented behavior includes outbound notifications to a personal contact, cron manipulation, and operational retry automation that are outside the core stated purpose of video production. Hidden or weakly disclosed messaging and persistence features create a real exfiltration and unauthorized automation risk because project metadata or local system state may be transmitted or scheduled without adequate user awareness.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior includes outbound notifications to a personal contact, cron manipulation, and operational retry automation that are outside the core stated purpose of video production. Hidden or weakly disclosed messaging and persistence features create a real exfiltration and unauthorized automation risk because project metadata or local system state may be transmitted or scheduled without adequate user awareness.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior includes outbound notifications to a personal contact, cron manipulation, and operational retry automation that are outside the core stated purpose of video production. Hidden or weakly disclosed messaging and persistence features create a real exfiltration and unauthorized automation risk because project metadata or local system state may be transmitted or scheduled without adequate user awareness.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented behavior includes outbound notifications to a personal contact, cron manipulation, and operational retry automation that are outside the core stated purpose of video production. Hidden or weakly disclosed messaging and persistence features create a real exfiltration and unauthorized automation risk because project metadata or local system state may be transmitted or scheduled without adequate user awareness.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L06 states 'Does NOT generate media itself,' which asserts a non-generative role. However, the documented behavior includes selecting engines and performing 'GENERATION' in the pipeline at L29, meaning the system does participate in media generation by invoking external engines.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README shows real shell patterns for setting provider API keys but gives no accompanying guidance about treating those credentials as secrets, avoiding screenshots/logging, and never committing them to files or shell history. In a skill meant for repeated operational use, this omission can normalize unsafe credential handling and increase the chance of accidental disclosure or misuse of paid cloud APIs.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence

Finding

The skill documents use of environment variables, local file writes, networked API access, and shell commands, but the manifest does not declare any tool scope or permissions boundary. That weakens reviewability and allows the skill to present broader operational behavior than a consumer or platform policy engine can validate up front.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Telegram-based escalation and notification workflows introduce outbound communication capabilities not reflected in the declared skill purpose. Undisclosed messaging channels are risky because they can leak job status, filenames, prompts, or other project details to external services without a clear trust boundary.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

A cron-based quota watcher that retries jobs and notifies a user is operational automation beyond the core media-processing role. Persistent scheduled execution can outlive the original user intent, repeatedly access local resources, and disclose runtime information through logs or notifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advises installing a cron watcher that logs to /tmp and sends notifications, but does not warn that command output, file paths, project names, or error details may be exposed in logs or external messages. This is especially risky because cron runs unattended and users may not monitor what data is emitted over time.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The documented crontab modification creates persistent scheduled execution outside the immediate session. Session persistence is dangerous in agent skills because it can continue running unattended, retry commands, write logs, or trigger notifications long after the user believes the task is complete.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

chmod +x scripts/quota_watcher.sh

Add to crontab:

(crontab -l 2>/dev/null | grep -v quota_watcher;
echo "*/30 * * * * /path/to/quota_watcher.sh >> /tmp/quota_watcher.log 2>&1") | crontab -

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Telling users to place a long-lived Google API key in a shell startup file encourages broad persistence of sensitive credentials without warning about exposure to other processes, backups, shared accounts, or accidental check-in. In a local automation skill that also uses shell and network operations, this increases the blast radius if the workstation or profile is compromised.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation extends the skill from transient video generation into persistent character tracking, prompt weighting, and cross-campaign archival. That materially changes the data handling model by retaining identity-related and behavioral information over time, increasing privacy, profiling, and unintended reuse risks beyond the stated video-production scope.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instructions require indefinite logging of generation attempts and persistence of campaign-related data across runs, including prompts, outputs, scores, and human review outcomes. Long-term retention of creative content and identity-related metadata increases breach impact, unauthorized reuse risk, and privacy exposure without any stated minimization or deletion policy.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

A video-production skill does not inherently need Telegram escalation, so this capability is difficult to justify under least privilege. Extra outbound channels enlarge the attack and data-leak surface, especially when they may carry scene IDs, scores, drift notes, or other operational metadata.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest describes a video-production skill centered on storyboard creation, Veo 3 batch generation, browser preview, feedback loops, and ffmpeg assembly. This file instead calls the OpenAI images generation API with model 'dall-e-3' and saves a single PNG frame, which is a materially different capability than the declared Veo 3 video pipeline.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · dalle_generator.py (reported line 26)May include surrounding context.

python

def generate_frame(prompt, filename=None):
    """Generate a single frame using DALL-E 3"""
    try:
        url = "https://api.openai.com/v1/images/generations"
        
        headers = {
            "Authorization": f"Bearer {API_KEY}",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · dalle_generator.py (reported line 43)May include surrounding context.

python

print(f"🎨 Generating: {prompt[:60]}...")
        
        response = requests.post(url, headers=headers, json=payload)
        
        if response.status_code == 200:
            data = response.json()

Tainted flow: 'image_url' from requests.post (line 47, network input) → requests.get (network output)

Medium

• Category: Data Flow
• Confidence: 88% confidence

Finding

The code takes an image URL returned by a remote API and fetches it without validating the destination, scheme, or host. If that upstream response were compromised or malformed, this could enable server-side request forgery–style behavior or unexpected downloads from attacker-controlled locations, which is more relevant in an automation skill that may run in privileged environments.

Content

Scanner excerpt · dalle_generator.py (reported line 50)May include surrounding context.

python

image_url = data["data"][0]["url"]
            
            # Download image
            img_response = requests.get(image_url)
            img = Image.open(BytesIO(img_response.content))
            
            if filename is None:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/platform-guide-veo3.md (reported line 10)May include surrounding context.

md

### 1. Google Cloud Project
1. Go to: https://console.cloud.google.com
2. Create new project (e.g., "Video Production")
3. Enable Generative AI API in APIs & Services

### 2. Billing

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide instructs users to place a live API key directly in shell commands and append it to a persistent shell startup file. This can expose the credential through shell history, shoulder-surfing, screen recording, logs, backups, and accidental disclosure from dotfile sharing; in this skill context, the key grants billable access to cloud AI services, making misuse financially and operationally harmful.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/ffmpeg_assembler.py (reported line 30)May include surrounding context.

python

def get_clip_duration(path: Path) -> float:
    """Get actual clip duration via ffprobe."""
    result = subprocess.run(
        ["ffprobe", "-v", "error", "-show_entries", "format=duration",
         "-of", "default=noprint_wrappers=1:nokey=1", str(path)],
        capture_output=True, text=True

Static analysis

No suspicious patterns detected.