free-mp4-pptzc

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:52 AM UTC
• Version: 1.0.0

Overview

The skill mostly does presentation-video work, but HTML mode can silently render hardcoded branded/sample slides and it can auto-install unpinned browser tooling during normal use.

Install only if you are comfortable with a media-generation skill that may modify your Python environment, download Playwright/Chromium, and send narration text to Edge TTS. Avoid HTML-template mode until the templates are fixed to render your actual content and remove undeclared branding/sample claims.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/make_video_html.py:114

Finding

Hardcoded Templates Hijack User-Requested Presentation Output

Content

View full analysis

SenseNova 6.7 Flash-Lite

Work results presentation and future outlook

SenseTime AI Assistant ``` ```html

Create a memory system

...

MEMORY.md - Long-term memory repository

memory/ - Daily log folder

memory/2026-05-03.md - First diary entry

``` ```html

Looking forward to continuing our cooperation!

Creating more possibilities together

... SenseNova 6.7 Flash-Lite · SenseTime ``` ### Technical Analysis `generate_template()` attempts to replace `{{TITLE}}` and `{{CONTENT}}` with data parsed from the user's script. However, the bundled templates do not contain those placeholders. The replacement operations therefore have no effect. When HTML mode is selected, Playwright renders hardcoded presentation material, branding, dates, memory-system claims, and WeChat-related claims instead of the presentation requested by the user. This behavior silently changes the generated artifact while presenting itself as normal template-based processing. This is classified as skill instruction hijacking because the effective output objective is cha ...[truncated 1308 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/make_video_html.py:53

Finding

Automatic Installation of Unpinned Playwright and Chromium Dependencies

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/make_video_html.py:69

Finding

Predictable Temporary Files Permit Symlink-Based File Overwrite

Content

View full analysis

{{ const browser = await chromium.launch(); const page = await browser.newPage(); await page.setViewportSize({{ width: {WIDTH}, height: {HEIGHT} }}); await page.goto('file://{os.path.abspath(tmp_html)}'); await page.waitForTimeout(500); await page.screenshot({{ path: '{output_path}', fullPage: false }}); await browser.close(); console.log('Done'); }})(); ''' tmp_js = "temp_render.js" with open(tmp_js, 'w') as f: f.write(script) result = subprocess.run( ["node", tmp_js], capture_output=True, text=True ) # Clean up temporary files os.remove(tmp_html) os.remove(tmp_js) if result.returncode != 0: print(f"Rendering error: {result.stderr}") return False return True ``` ### Technical Analysis The rendering function creates `temp_slide.html` and `temp_render.js` in the current working directory using fixed, globally predictable names. It does not use secure exclusive creation, verify that the paths are regular files, or isolate files in a uniquely created temporary directory. On operating systems that follow symbolic links during file opening, an attacker with write access to the working directory can pre-create either filename as a symbolic link. Opening the path with mode `w` follows the link and truncates or overwrites the linked target with the generated HTML or JavaScript. The predic ...[truncated 2134 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (36)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README explicitly says the skill will automatically install dependencies and automatically send the generated result, but it does not document consent, prompts, scope limits, or what system changes may occur. In an agent environment, undisclosed package installation and autonomous output delivery can modify the host system and transmit artifacts without adequate user awareness, increasing operational and supply-chain risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README specifies '中文讲解配音' and gives an example of '中文女声' output, but it does not mention that users can choose another language or opt in to Chinese narration. This creates a natural-language locale policy concern because the skill appears to force a specific language by default without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly notes that Edge TTS requires network connectivity, but it does not clearly warn users that narration text will be transmitted to an external service. This creates a privacy and data-handling risk because users may unknowingly send sensitive script content off-device.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstrings, argparse descriptions, help text, and console messages are all written in Chinese, which imposes a specific language on users. There is no indication that the skill is region-specific or that users can opt into another language, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The default voice is fixed to zh-CN-XiaoxiaoNeural, and the file’s natural-language descriptions are also Chinese, which indicates the skill is designed to operate in a specific language/locale by default. There is no user-facing opt-in or explicit language selection guidance, so this can violate a language/locale policy requiring user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language strings entirely in Chinese, including the module docstring, CLI argument descriptions, and runtime print messages. The skill does not offer any language selection or document a region-specific constraint, which can violate a policy requiring user language/locale choice or opt-in.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/html_to_images.py (reported line 30)May include surrounding context.

python

with open(js_file, 'w') as f:
        f.write(script)
    
    result = subprocess.run(['node', js_file], capture_output=True, text=True)
    os.remove(js_file)
    return result.returncode == 0

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The comments at L52-L53 say Playwright is merely needed later and that actual rendering will be implemented in the future. However, the file already contains a concrete implementation in render_html_to_image that writes a temporary JavaScript file, invokes node, and produces screenshots. This is an active contradiction between the inline documentation and the code's implemented behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The default voice is fixed to "zh-CN-XiaoxiaoNeural", which imposes a specific language/locale choice in the generated audio. Although users can override it via --voice, the file's natural-language defaults and behavior still force Chinese output unless the user knows to change it, which is a locale-policy concern.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/make_video.py (reported line 118)May include surrounding context.

python

num = len(slide_files)
    
    # 获取音频时长
    probe = subprocess.run([ffmpeg_path, "-i", audio_file, "-hide_banner"],
                           capture_output=True, text=True)
    match = re.search(r'Duration: (\d+):(\d+):(\d+\.\d+)', probe.stderr)
    if match:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/make_video_html.py (reported line 158)May include surrounding context.

python

num = len(slide_files)
    
    # 获取音频时长
    probe = subprocess.run([ffmpeg_path, "-i", audio_file, "-hide_banner"],
                           capture_output=True, text=True)
    match = re.search(r'Duration: (\d+):(\d+):(\d+\.\d+)', probe.stderr)
    if match:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/make_video.py (reported line 150)May include surrounding context.

python

])
    
    print("合成中...")
    result = subprocess.run(cmd, capture_output=True, text=True)
    
    if result.returncode == 0:
        print(f"完成: {output_file}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/make_video_html.py (reported line 190)May include surrounding context.

python

])
    
    print("合成中...")
    result = subprocess.run(cmd, capture_output=True, text=True)
    
    if result.returncode == 0:
        print(f"完成: {output_file}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/make_video.py (reported line 47)May include surrounding context.

python

]
    for path in paths:
        try:
            result = subprocess.run([path, "-version"], capture_output=True)
            if result.returncode == 0:
                return path
        except:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/make_video_html.py (reported line 42)May include surrounding context.

python

]
    for path in paths:
        try:
            result = subprocess.run([path, "-version"], capture_output=True)
            if result.returncode == 0:
                return path
        except:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/make_video_html.py (reported line 53)May include surrounding context.

python

"""查找Playwright"""
    try:
        # 检查是否安装了playwright
        result = subprocess.run(["python", "-m", "playwright", "--version"], 
                               capture_output=True, text=True)
        if result.returncode == 0:
            return True

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Installing Playwright and Chromium through subprocess without a meaningful safety warning or consent undermines user expectations and can introduce downloaded code into the environment. In a skill setting, hidden or weakly disclosed installation behavior is especially concerning because it obscures network access and executable acquisition.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 89% confidence

Finding

The script can invoke pip to install Playwright at runtime, which is a real security concern because it expands the skill's capabilities from local video generation into package installation and execution of newly fetched code. Even though the command is hardcoded rather than user-injected, it still causes unreviewed network retrieval and execution in the current environment.

Content

Scanner excerpt · scripts/make_video_html.py (reported line 64)May include surrounding context.

python

def install_playwright():
    """安装Playwright"""
    print("安装Playwright...")
    subprocess.run(["pip", "install", "playwright"], check=True)
    subprocess.run(["python", "-m", "playwright", "install", "chromium"], check=True)

def render_html(html_content, output_path):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 90% confidence

Finding

Installing Chromium through Playwright at runtime downloads and prepares executable browser binaries, which materially increases the attack surface and introduces network-driven code acquisition. In a skill context, this is more dangerous than a normal subprocess because users may expect media generation, not automatic fetching of executable dependencies.

Content

Scanner excerpt · scripts/make_video_html.py (reported line 65)May include surrounding context.

python

"""安装Playwright"""
    print("安装Playwright...")
    subprocess.run(["pip", "install", "playwright"], check=True)
    subprocess.run(["python", "-m", "playwright", "install", "chromium"], check=True)

def render_html(html_content, output_path):
    """使用Playwright渲染HTML为图片"""

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 78% confidence

Finding

The script writes a JavaScript file and executes it with Node to render HTML, which is risky because the rendered HTML contains unescaped content derived from the input script. A malicious script file could inject HTML/JS into the temporary page, and that code would run inside Chromium when Playwright opens the local file.

Content

Scanner excerpt · scripts/make_video_html.py (reported line 93)May include surrounding context.

python

with open(tmp_js, 'w') as f:
        f.write(script)
    
    result = subprocess.run(["node", tmp_js], capture_output=True, text=True)
    
    # 清理临时文件
    os.remove(tmp_html)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script sends concatenated slide text to the Edge TTS service, which means user content leaves the local environment. Without an explicit warning or consent mechanism, sensitive or proprietary text could be transmitted to a third-party service unexpectedly.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The overall behavior of automatically installing Playwright and Chromium during execution is a real risky capability addition, not just an implementation detail. In this skill context, users likely expect slide rendering and video creation, so silent dependency installation makes the skill materially more dangerous and less predictable.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 80% confidence

Finding

The helper trusts any user-supplied --ffmpeg path or a bare 'ffmpeg' resolved from PATH and actively executes it to test availability. In environments where PATH or the provided path can be influenced, this can result in execution of a malicious binary, turning a media utility into an arbitrary code execution vector.

Content

Scanner excerpt · scripts/synthesize_video.py (reported line 19)May include surrounding context.

python

]
    
    for path in paths:
        if os.path.exists(path) or subprocess.run([path, "-version"], 
                                                   capture_output=True).returncode == 0:
            return path

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/synthesize_video.py (reported line 37)May include surrounding context.

python

# 获取音频时长
    probe_cmd = [ffmpeg_path, "-i", audio_file, "-hide_banner"]
    probe_result = subprocess.run(probe_cmd, capture_output=True, text=True)
    
    # 解析时长（从stderr中提取）
    import re

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/synthesize_video.py (reported line 97)May include surrounding context.

python

# 获取音频时长
    probe_cmd = [ffmpeg_path, "-i", audio_file, "-hide_banner"]
    probe_result = subprocess.run(probe_cmd, capture_output=True, text=True)
    
    # 解析时长（从stderr中提取）
    import re

Static analysis

No suspicious patterns detected.