Security audit

Picasso TikTok

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent TikTok/Reels video pipeline, but it routes generated voice audio through an unrelated public file host and includes opinionated promotional script defaults that users should review carefully.

Install only if you are comfortable sending scripts, audio, prompts, and generated media to the listed AI providers, and do not use it for confidential voiceovers unless the uguu.se upload is replaced with private, expiring storage or an official HeyGen upload path. Also review the generated script for unwanted CTA or brand language before approving audio generation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:61
Finding: Mandatory Promotional CTA Alters User-Requested Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:148
Finding: Generated Voice Audio Is Uploaded to an Unrelated Public File Host
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:40
Finding: Unpinned Package Installation Creates a Mutable Supply-Chain Dependency
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (18)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs uploading generated audio to uguu.se, a public third-party file host, solely to obtain a URL for HeyGen. This exposes potentially sensitive voice/script content to an unrelated service without any user-facing disclosure, retention guarantees, access controls, or consent step, creating a real confidentiality and data-governance risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script rules require 'Español argentino rioplatense (voseo)' as a fixed output style. This imposes a specific locale and language variant without indicating that the user can choose another language or dialect, which conflicts with the language/locale policy criteria.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
import requests, time CACHE = "/home/ubuntu/clawd/projects/picasso-tiktok/cache/JOB_NAME" BASE_URL = "https://api.elevenlabs.io/v1/text-to-speech/$ELEVENLABS_VOICE_ID" HEADERS = {"xi-api-key": "$ELEVENLABS_API_KEY", "Content-Type": "application/json"} # Variación A — expresivo, pausas fuertes

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
md
] for ver, text, settings in configs: r = requests.post(BASE_URL, headers=HEADERS, json={"text": text, "model_id": "eleven_multilingual_v2", "voice_settings": settings}) with open(f"{CACHE}/audio_{ver}.mp3", "wb") as f: f.write(r.content)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
Backup: Cartesia sonic-3

python
r = requests.post("https://api.cartesia.ai/tts/bytes", headers={"X-API-Key": "$CARTESIA_API_KEY", "Cartesia-Version": "2025-04-16", "Content-Type": "application/json"}, json={"model_id": "sonic-3", # SIEMPRE sonic-3, nunca sonic-2

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
Backup: Cartesia sonic-3

python
r = requests.post("https://api.cartesia.ai/tts/bytes", headers={"X-API-Key": "$CARTESIA_API_KEY", "Cartesia-Version": "2025-04-16", "Content-Type": "application/json"}, json={"model_id": "sonic-3", # SIEMPRE sonic-3, nunca sonic-2

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.
Backup: Cartesia sonic-3

python
r = requests.post("https://api.cartesia.ai/tts/bytes", headers={"X-API-Key": "$CARTESIA_API_KEY", "Cartesia-Version": "2025-04-16", "Content-Type": "application/json"}, json={"model_id": "sonic-3", # SIEMPRE sonic-3, nunca sonic-2

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 380)May include surrounding context.
Backup: Cartesia sonic-3

python
r = requests.post("https://api.cartesia.ai/tts/bytes", headers={"X-API-Key": "$CARTESIA_API_KEY", "Cartesia-Version": "2025-04-16", "Content-Type": "application/json"}, json={"model_id": "sonic-3", # SIEMPRE sonic-3, nunca sonic-2

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
Backup: Cartesia sonic-3

python
r = requests.post("https://api.cartesia.ai/tts/bytes", headers={"X-API-Key": "$CARTESIA_API_KEY", "Cartesia-Version": "2025-04-16", "Content-Type": "application/json"}, json={"model_id": "sonic-3", # SIEMPRE sonic-3, nunca sonic-2

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
Backup: Cartesia sonic-3

python
r = requests.post("https://api.cartesia.ai/tts/bytes", headers={"X-API-Key": "$CARTESIA_API_KEY", "Cartesia-Version": "2025-04-16", "Content-Type": "application/json"}, json={"model_id": "sonic-3", # SIEMPRE sonic-3, nunca sonic-2

External Transmission

Medium

Category: Data Exfiltration
Confidence: 99% confidence
Finding: This upload sends audio.mp3 to uguu.se, a public third-party file host, before passing the resulting URL to HeyGen. Unlike the other API calls, this introduces unnecessary exposure to an uncontrolled intermediary and may make the file publicly accessible or retrievable by others.
Content: Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.
import requests

with open("audio.mp3", "rb") as f: r = requests.post("https://uguu.se/upload", files={"files[]": ("audio.mp3", f.read(), "audio/mpeg")}, timeout=30) audio_url = r.json()["files"][0]["url"]

text

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
md
HEYGEN_KEY = "$HEYGEN_API_KEY" AVATAR_ID = "aa7ca06de7454b9caa147b97a534e813" # Paul default r = requests.post("https://api.heygen.com/v2/video/generate", headers={"X-Api-Key": HEYGEN_KEY, "Content-Type": "application/json"}, json={ "video_inputs": [{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.
md
HEYGEN_KEY = "$HEYGEN_API_KEY" AVATAR_ID = "aa7ca06de7454b9caa147b97a534e813" # Paul default r = requests.post("https://api.heygen.com/v2/video/generate", headers={"X-Api-Key": HEYGEN_KEY, "Content-Type": "application/json"}, json={ "video_inputs": [{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.
md
HEYGEN_KEY = "$HEYGEN_API_KEY" AVATAR_ID = "aa7ca06de7454b9caa147b97a534e813" # Paul default r = requests.post("https://api.heygen.com/v2/video/generate", headers={"X-Api-Key": HEYGEN_KEY, "Content-Type": "application/json"}, json={ "video_inputs": [{

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.
md
import requests, os with open("audio.mp3", "rb") as f: r = requests.post("https://api.openai.com/v1/audio/transcriptions", headers={"Authorization": f"Bearer {os.environ['OPENAI_API_KEY']}"}, files={"file": ("audio.mp3", f, "audio/mpeg")}, data={"model": "whisper-1", "response_format": "verbose_json",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 380)May include surrounding context.
python
import requests, os, time r = requests.post("https://api.replicate.com/v1/models/runwayml/gen-4.5/predictions", headers={"Authorization": f"Token {os.environ['REPLICATE_API_TOKEN']}", "Content-Type": "application/json"}, json={"input": { "prompt": "DESCRIPCION_CINEMATOGRAFICA",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 380)May include surrounding context.
python
import requests, os, time r = requests.post("https://api.replicate.com/v1/models/runwayml/gen-4.5/predictions", headers={"Authorization": f"Token {os.environ['REPLICATE_API_TOKEN']}", "Content-Type": "application/json"}, json={"input": { "prompt": "DESCRIPCION_CINEMATOGRAFICA",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 391)May include surrounding context.
python
import requests, os, time r = requests.post("https://api.replicate.com/v1/models/runwayml/gen-4.5/predictions", headers={"Authorization": f"Token {os.environ['REPLICATE_API_TOKEN']}", "Content-Type": "application/json"}, json={"input": { "prompt": "DESCRIPCION_CINEMATOGRAFICA",

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Missing User Warnings

Natural-Language Policy Violations

External Transmission

External Transmission

External Transmission

Backup: Cartesia sonic-3

External Transmission

Backup: Cartesia sonic-3

External Transmission

Backup: Cartesia sonic-3

External Transmission

Backup: Cartesia sonic-3

External Transmission

Backup: Cartesia sonic-3

External Transmission

Backup: Cartesia sonic-3

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Static analysis