Sora Video Generation

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:57 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims: it generates Sora videos through OpenAI's API, with ordinary API-key and file-output risks that users should understand.

Install only if you are comfortable sending video prompts and any reference images to OpenAI for processing. Prefer OPENAI_API_KEY from a protected environment or secret manager instead of --api-key, review dependency resolution if you need reproducible installs, and choose output paths carefully because the script writes the requested MP4 file.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_video.py:2
• Finding: Unpinned Runtime Dependencies Allow Unreviewed Package Versions## Vulnerability Details **File Location**: `scripts/generate_video.py`, lines 2-8 **Vulnerability Type**: Supply-chain risk caused by minimum-only dependency constraints **Risk Level**: Medium **Vulnerable Code**: ```python # /// script # requires-python = ">=3.10" # dependencies = [ # "openai>=1.0.0", # "httpx>=0.25.0", # "pillow>=10.0.0", # ] # /// ``` ### Technical Analysis The inline dependency metadata specifies only minimum acceptable versions. It does not pin exact reviewed releases or provide integrity hashes. When the documented `uv run` invocation resolves these dependencies, it may install future package versions that were not present during this audit. This creates a non-reproducible execution environment and expands the supply-chain attack surface. If a permitted future release is compromised, dependency resolution can introduce and execute malicious package code when the script imports `openai`, `httpx`, or `PIL`. The use of legitimate package names reduces dependency-confusion risk, but unrestricted future versions still create an unsafe dependency update path. ### Attack Path 1. An attacker compromises a future release of one of the declared packages or its publishing process. 2. The malicious release remains compatible with the minimum-only version constraint. 3. A user invokes the Skill through the documented `uv run` command in an environment without a locked dependency set. 4. The resolver downloads and installs the compromised release. 5. The script imports the affected package. 6. Package initialization or imported functionality executes attacker-controlled code with the permissions of the user running the Skill. ### Impact Assessment A malicious dependency would execute with the same local privileges as the Skill process. Depending on those privileges, it could read accessible files and environment variables, including `OPENAI_API_KEY`, modify user-owned files, make ...[truncated 233 chars]
• Remediation: ## Remediation Suggestions - Pin every dependency to an exact, reviewed version rather than using minimum-only constraints. - Generate and commit a lockfile that records the full transitive dependency graph. - Require package hashes or another integrity-verification mechanism where supported. - Resolve packages only from explicitly configured, trusted registries. - Perform dependency upgrades through a controlled review and testing process. - Use automated vulnerability and provenance scanning before approving updated packages. - Run the Skill with least privilege and expose only the files and environment variables required for video generation.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/generate_video.py:122
• Finding: OpenAI API Key Can Be Exposed Through Command-Line Arguments## Vulnerability Details **File Location**: `scripts/generate_video.py`, lines 122-125 **Vulnerability Type**: Sensitive credential exposure through process arguments and shell history **Risk Level**: Low **Vulnerable Code**: ```python parser.add_argument( "--api-key", "-k", help="OpenAI API key (overrides OPENAI_API_KEY env var)" ) ``` ### Technical Analysis The script permits an OpenAI API key to be supplied directly as a command-line argument. Command-line secrets may be recorded in interactive shell history, terminal logs, process-monitoring systems, audit logs, automation logs, or process argument listings. Although the script also supports `OPENAI_API_KEY`, retaining the command-line option encourages a less secure credential-delivery method. The script does not print the key itself, and exploitation requires access to one of the local or operational records containing the command invocation. ### Attack Path 1. A user invokes the script with `--api-key` or `-k` followed by a valid OpenAI API key. 2. The command and key are retained in shell history, automation logs, process telemetry, or a process argument listing. 3. A local user, monitoring process, log reader, or other actor with access to that record retrieves the key. 4. The actor uses the exposed credential to authenticate to OpenAI services until the key is revoked or expires. ### Impact Assessment Exposure may allow unauthorized use of the affected OpenAI account or project within the permissions assigned to the key. Potential consequences include consumption of API quota, generation charges, access to API resources available to that credential, and disruption through quota exhaustion. This issue does not directly grant operating-system privilege escalation. Its practical scope depends on the key's configured permissions, billing limits, lifetime, and the attacker's ability to inspect process metadata or command records.
• Remediation: ## Remediation Suggestions - Remove the `--api-key` and `-k` command-line options. - Obtain the credential from a protected environment variable, operating-system keychain, secret manager, or permission-restricted credential file. - For interactive use, accept secrets through a non-echoing prompt rather than through process arguments. - Ensure CI and automation platforms inject the credential through their native secret-management facilities and mask it in logs. - Assign the API key only the permissions required for video generation and apply appropriate usage or billing limits. - Rotate the key immediately if it has previously appeared in shell history, logs, or process telemetry. - Document secure credential handling and advise users not to place secrets in command-line arguments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

def get_api_key(provided_key: str | None) -> str | None:
    """Get API key from argument first, then environment."""
    if provided_key:
        return provided_key
    return os.environ.get("OPENAI_API_KEY")

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documents use of environment variables and outbound network access but do not declare any tool scope such as permissions or allowed-tools. This creates a mismatch between what the skill can do and what is explicitly constrained, increasing the chance that an agent invokes it with broader capabilities than intended.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The description says to use the skill when the user asks to generate, create, or make videos, which are broad trigger phrases that can match many benign or ambiguous requests. Overly broad invocation criteria can cause the agent to activate this skill unnecessarily, leading to unintended external API calls or transmission of user content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The markdown describes using prompts and optional reference images with a remote API but does not clearly warn that this content is sent to an external service. Users may provide sensitive text or private images without understanding the disclosure, creating confidentiality and privacy risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""Download video content using httpx."""
    import httpx
    
    url = f"https://api.openai.com/v1/videos/{video_id}/content"
    headers = {"Authorization": f"Bearer {api_key}"}
    
    try:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

"""Download video content using httpx."""
    import httpx
    
    url = f"https://api.openai.com/v1/videos/{video_id}/content"
    headers = {"Authorization": f"Bearer {api_key}"}
    
    try:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.