AI Video Gen CN

• Outcome: Pass
• Latest audit: May 28, 2026 · 6:32 AM UTC
• Version: 1.0.0

Overview

This appears to be a straightforward AI video-generation skill, with normal but under-documented privacy, cost, dependency, and file-overwrite risks.

Install only if you are comfortable sending prompts, narration, and generated media to third-party AI providers and potentially incurring API costs. Use dedicated API keys with spending limits, keep .env out of source control, avoid confidential or regulated content unless provider policies allow it, and write outputs to fresh filenames to avoid accidental overwrites.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tainted flow: 'video_url' from requests.get (line 125, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

# Download video
        video_path = self.output_dir / f"video_{int(time.time())}.mp4"
        video_data = requests.get(video_url).content
        with open(video_path, 'wb') as f:
            f.write(video_data)

• Confidence: 82% confidence
• Finding: The code downloads a video from a URL taken from an API response without validating the destination host or scheme. If the upstream service or response is compromised, this could be abused for SSRF-like outbound access or retrieval of unexpected content into the local environment.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises capabilities that require access to environment variables, filesystem writes, network calls, and shell/FFmpeg execution, but it does not declare permissions or boundaries for those actions. This creates a real security and governance risk because users and host systems cannot make an informed trust decision, and the shell/network combination increases the potential blast radius if the underlying scripts are misused or compromised.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The quick-start explicitly instructs users to store live API secrets in a `.env` file but does not warn them to keep that file out of source control or protect it locally. In a developer workflow, this omission materially increases the chance of accidental credential exposure through Git commits, screenshots, shared archives, or copied examples, which could lead to unauthorized API usage and billing abuse.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README instructs users to configure API keys and use external providers like OpenAI, LumaAI, Runway, ElevenLabs, and Replicate, but it does not disclose that prompts, narration text, images, and possibly video/media inputs may be transmitted to those third parties. This creates a privacy and data-handling risk because users may unknowingly submit sensitive or regulated content to external services under separate retention and usage policies.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill routes user prompts and potentially generated or uploaded media to external providers such as OpenAI, Replicate, LumaAI, Runway, and ElevenLabs, yet the description does not warn users that their text, images, audio, or video may leave the local environment. This is dangerous because users may unknowingly transmit sensitive, proprietary, or regulated content to third parties with separate retention and training policies.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The documented workflow writes output media files and performs editing operations, but it does not warn that generated outputs or editing steps may overwrite existing files or modify local media artifacts if unsafe paths are chosen. While this is less severe than arbitrary code execution, it can still cause data loss or accidental corruption of user content during routine use.

Missing User Warnings

Low

• Confidence: 78% confidence
• Finding: The script writes a predictable temporary file named filelist.txt in the current working directory, which can create race-condition or symlink risks in shared directories. An attacker with filesystem access could pre-create or replace that path to overwrite arbitrary files or influence FFmpeg's input list.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrase "视频制作" is broad and can match many ordinary user requests about making or editing videos, increasing the chance this skill activates outside a clearly intended scope. Because the skill can invoke external AI/video services and potentially consume API-backed resources, accidental activation can lead to unintended tool use, cost, and confusing behavior.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The English trigger "generate video" is highly generic and likely to appear in normal conversation, making reliable scoped activation difficult. In a skill that can call third-party generation services and use secrets, this raises the risk of accidental invocation, unintended external requests, and unnecessary API consumption.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger "ai video" is ambiguous and likely to match casual discussion rather than a deliberate request to run this specific skill. Since the skill's stated capabilities include image generation, video synthesis, voice-over, and FFmpeg editing, accidental activation could chain into multiple external operations with cost and privacy implications.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
replicate>=0.20.0
requests>=2.31.0
pillow>=10.0.0

• Confidence: 92% confidence
• Finding: The dependency is specified with a lower bound only, which allows future major or minor versions to be installed without review. This creates supply-chain and stability risk because a later release could introduce a vulnerable or incompatible version into the skill environment.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
replicate>=0.20.0
requests>=2.31.0
pillow>=10.0.0
python-dotenv>=1.0.0

• Confidence: 92% confidence
• Finding: The dependency is unpinned and may resolve to different versions over time, making builds non-reproducible and increasing exposure to newly introduced malicious or vulnerable releases. In a skill that depends on third-party AI service SDKs, this expands the supply-chain attack surface.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
replicate>=0.20.0
requests>=2.31.0
pillow>=10.0.0
python-dotenv>=1.0.0

• Confidence: 95% confidence
• Finding: Using requests with only a minimum version allows installation of arbitrary later releases, which is risky because this package already has multiple published advisories. In a network-heavy video generation skill that likely handles API keys and remote content, dependency drift can increase exposure to credential leakage or transport-security defects.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
replicate>=0.20.0
requests>=2.31.0
pillow>=10.0.0
python-dotenv>=1.0.0

• Confidence: 97% confidence
• Finding: Pillow is unpinned and processes image data, a high-risk input class because malformed media files often trigger parsing vulnerabilities. Allowing uncontrolled upgrades increases the chance of pulling a version with a critical image-processing flaw or breaking security assumptions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

replicate>=0.20.0
requests>=2.31.0
pillow>=10.0.0
python-dotenv>=1.0.0

• Confidence: 88% confidence
• Finding: An unpinned python-dotenv dependency can change behavior or pull in a later vulnerable release, reducing reproducibility and increasing supply-chain risk. While lower impact than media or networking libraries, it may still affect handling of sensitive environment configuration.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 73% confidence
• Finding: The file permits installation of requests versions that may include known vulnerabilities, and requests is central to outbound HTTP interactions where API tokens, .netrc credentials, and TLS behavior matter. In this skill's context, which likely communicates with multiple external AI providers, a vulnerable HTTP client can expose secrets or weaken request security.

Known Vulnerable Dependency: pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: Pillow has a history of severe flaws including image parsing bugs and possible code-execution or denial-of-service issues, and this skill is explicitly built around image/video generation and editing. Because it is likely to ingest or transform untrusted media artifacts from prompts or external services, a vulnerable Pillow version materially increases exploitability and impact.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 61% confidence
• Finding: The requirements allow python-dotenv versions that may contain a symlink-following file overwrite issue in set_key. This is lower risk because exploitation depends on the application actually invoking the vulnerable write path against attacker-influenced filesystem targets, which is not shown here, but the dependency exposure is still real.

Static analysis

No suspicious patterns detected.