Security audit

Ai Director

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its AI video-generation purpose, but it needs Review because one automation script can execute shell commands through prompts and credential files are weakly scoped.

Review before installing. Use this only in an isolated environment with budget caps and disposable or tightly scoped API keys. Do not use auto-iterate until shell execution is patched. Avoid shared hosts unless USER_ID is validated, credential files are confined to the credentials directory, and secrets are stored with restrictive permissions or a proper secret store. Confirm every paid generation or retry and review what content will be sent to X2C/Giggle and Gemini.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/auto-iterate.js:106
Finding: Shell Command Injection Through User and Model-Generated Input
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/config-loader.js:10
Finding: Path Traversal in Per-User Credential File Resolution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/config-loader.js:43
Finding: Credential Files Written Without Restrictive Permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (42)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The documented behavior includes user-specific credential/config file access and persistence, but those sensitive data-handling features are not prominently represented in the declared purpose. Hidden or under-described secret handling raises the risk of accidental exposure, unsafe deployment, and misuse in multi-user environments where user IDs and local files determine isolation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior includes user-specific credential/config file access and persistence, but those sensitive data-handling features are not prominently represented in the declared purpose. Hidden or under-described secret handling raises the risk of accidental exposure, unsafe deployment, and misuse in multi-user environments where user IDs and local files determine isolation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior includes user-specific credential/config file access and persistence, but those sensitive data-handling features are not prominently represented in the declared purpose. Hidden or under-described secret handling raises the risk of accidental exposure, unsafe deployment, and misuse in multi-user environments where user IDs and local files determine isolation.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/quality-evaluator.js (reported line 182)May include surrounding context.
js
请仔细观看视频后给出评分。`; return prompt; } // 调用 Gemini API

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill declares access to sensitive environment variables such as X2C_API_KEY but does not define an explicit tool scope or permissions boundary. In an agent ecosystem, missing scope declarations increase the chance that the skill can access secrets or invoke capabilities more broadly than users expect, which undermines least-privilege and informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill exposes billable script and video generation commands, including a recommended full-workflow path, but does not place clear cost warnings and confirmation requirements directly alongside those commands. In agent-driven usage, this can lead to accidental charges or unauthorized spending, especially because the workflow can trigger multiple paid operations against a stored API key.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs users to store X2C API credentials in local JSON files under predictable per-user paths without warning about plaintext secret risk. If the host is shared, backed up, synced, or improperly permissioned, those API keys could be stolen and abused for account access and billable operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: 该文件从描述、角色设定到输出格式与示例均以中文撰写，并默认要求生成中文短剧内容，没有提供用户可选择其他语言的选项。根据规则，未经用户选择而强制特定语言/locale 属于自然语言政策问题。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The quick-start section says generated scripts are automatically uploaded to Feishu documents and a link is returned. However, the rest of the document describes a local file-based management system using local project directories and CLI/Python save operations, with no Feishu integration described. This is a clear manifest/documented behavior mismatch about where outputs are stored.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide states that generated scripts are automatically uploaded to Feishu documents, but it does not warn users that their content will be transmitted to a third-party service or require explicit confirmation. This can lead to unintended disclosure of sensitive creative, business, or personal data, especially in a commercial writing workflow where users may paste proprietary material.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises automatic local saving and version history, but it does not clearly warn users that their generated content will persist on disk across sessions. Persistent storage of scripts, revisions, and metadata can expose confidential material to other local users, backups, logs, or later unintended disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The automated workflow describes silently creating projects, saving scripts, and updating metadata during creation and continuation, without an explicit user-facing warning. Hidden stateful behavior increases the chance that users unknowingly leave sensitive content and activity traces on the system, which is particularly risky for commercial or client work.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The agent-facing API reference recommends charge-incurring generation commands as the primary workflow but does not place a clear warning near those commands that they consume credits and may trigger real billing. In an autonomous or semi-autonomous agent context, this omission increases the chance of unintended paid operations, repeated retries, and budget overrun because the interface is presented as safe to execute programmatically.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file contains user-facing operational instructions exclusively in Chinese, and there is no indication that users may choose another language or that the content is intentionally limited to a Chinese-only audience. That can conflict with language/locale policy requirements that prohibit forcing a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation states that the language parameter defaults to zh, and nearby examples and category metadata are oriented toward Chinese output. This creates a locale/language default that may force a specific language unless the caller explicitly overrides it, which is a natural-language policy concern under the language/locale rule.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/X2C-OPEN-API.md (reported line 356)May include surrounding context.

project/publish → Publish to platform

text
### cURL Example ```bash # Step 1: Send verification code

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This markdown file documents use of a remote API endpoint and instructs callers to send an x-auth API key, but it does not include any warning that the skill communicates with an external service or that credentials will be transmitted in requests. For markdown files, missing warnings about behaviors affecting privacy or system integrity should be flagged when such networked credential use is described without disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Generate Script example explicitly sets "language": "zh-CN", which imposes a specific locale in the documented behavior. The file does not indicate that language is configurable by user preference or that this is merely one optional example, so it presents a natural-language locale constraint without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This markdown file includes concrete curl examples for project/create and repeated project/update operations, which affect remote user/project data. The document presents these actions as procedural steps but does not warn that executing them will create or modify server-side resources.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/api-flow-v3-log.md (reported line 44)May include surrounding context.
1. project/create

bash
curl -X POST "https://giggle.pro/api/v1/project/create" \ -H "x-auth: $API_KEY" \ -H "Content-Type: application/json" \ -d '{"name": "api-flow-test-v3", "type": "director", "aspect": "16:9"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The markdown shows price-query endpoints and then documents image/video generation at a quantified total cost, including 12 video generations. Although pricing is listed, there is no explicit caution that running the workflow may incur significant charges and should be confirmed before execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This markdown file presents the skill content exclusively in Chinese, and there is no natural-language indication that the user may choose another language or that the locale restriction is intentional and justified. Under the policy rule for language/locale choice, forcing a specific language without opt-in is a policy concern.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/workflow-notes.md (reported line 12)May include surrounding context.
md
## API Base URL ⚠️ **重要**: 使用 `https://giggle.pro/api/v1/...`，不是 `https://api.giggle.pro/...` ## 完整流程步骤

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/workflow-notes.md (reported line 46)May include surrounding context.
每个环节完成后都需要调用！

bash
curl -X POST "https://giggle.pro/api/v1/project/update" \ -H "x-auth: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"project_id": "xxx"}'

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/workflow-notes.md (reported line 186)May include surrounding context.
bash
# ⚠️ DEPRECATED - 请使用 generate-video 逐个调用 curl -X POST "https://giggle.pro/api/v1/storyboard-shots/auto-generate-video" \ -H "x-auth: YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/ad-account-manager.js:65

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/auto-iterate.js:108

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/ad-account-manager.js:187

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/ad-producer.js:552

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/quality-evaluator.js:28

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

SkillSpector

Tp4

Tp4

Tp4

Direct Prompt Extraction

Undeclared Tool Scope

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Description-Behavior Mismatch

Missing User Warnings

Missing User Warnings

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Natural-Language Policy Violations

External Transmission

Missing User Warnings

Natural-Language Policy Violations

Missing User Warnings

External Transmission

1. project/create

Missing User Warnings

Natural-Language Policy Violations

External Transmission

External Transmission

External Transmission

Static analysis

Shell command execution detected (child_process).

Shell command execution detected (child_process).

File appears to expose a hardcoded API secret or token.

File appears to expose a hardcoded API secret or token.

File appears to expose a hardcoded API secret or token.