Security audit

video-generator

Security checks for vulnerabilities and agentic risk

Overview

This video-generation skill is mostly coherent, but it uploads user media through a public plaintext HTTP URL path and uses unpinned dependencies, so users should review it before installing.

Install only if you are comfortable sending selected media and prompts to Deep Code Plus and having local uploads referenced through a public HTTP URL. Avoid private or sensitive images, audio, or video unless the publisher moves uploads to HTTPS/private signed URLs with cleanup, and consider installing dependencies in an isolated environment with pinned versions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: scripts/requirements.txt:1
Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `scripts/requirements.txt:1-2`; installation documented at `SKILL.md:8` **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium ### Vulnerable Code `scripts/requirements.txt:1-2`: ```text qiniu>=7.13 requests>=2.32 ``` `SKILL.md:8`: ```text The dependency installation command is `python3 -m pip install -r scripts/requirements.txt`. ``` ### Technical Analysis Both dependencies use open-ended minimum-version constraints. Consequently, the documented installation command can resolve to any later version available from the configured Python package index. The installed code can therefore differ from the dependency code that was reviewed during this audit. Python packages may execute build-backend or installation logic, and their imported modules execute with the privileges of the process running this skill. If a future compatible release, transitive dependency, package-index account, or distribution artifact is compromised, a user following the documented installation process could install attacker-controlled code. The manifest also lacks integrity hashes or a lock file, so package artifacts are not cryptographically tied to reviewed versions. ### Attack Path 1. An attacker compromises a permitted future release of `qiniu`, `requests`, or one of their resolved dependencies. 2. The malicious release remains compatible with the open-ended `>=` constraint. 3. A user runs the documented `python3 -m pip install -r scripts/requirements.txt` command. 4. The package resolver downloads the compromised release rather than a previously reviewed version. 5. Malicious installation or runtime code executes when the package is installed or imported by `video_generator.py`. ### Impact Assessment Successful exploitation could execute arbitrary Python code with the privileges of the user performing installation or running the skill. This could expose local files and credentials accessi ...[truncated 368 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to an exact reviewed version, for example: ```text qiniu==<reviewed-version> requests==<reviewed-version> ``` 2. Generate a fully resolved lock file that also pins transitive dependencies. 3. Record SHA-256 hashes for all accepted distribution artifacts and install with pip's `--require-hashes` option. 4. Use an organization-controlled package mirror or allowlisted package source. 5. Review and update dependency pins through a controlled process with automated vulnerability and provenance checks. 6. Install dependencies in an isolated virtual environment under a non-privileged account. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/video_generator.py:19
Finding: User Media Is Referenced Through Plaintext HTTP URLs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/video_generator.py:19`, `scripts/video_generator.py:176-189` **Vulnerability Type**: Plaintext transport and bearer-style exposure of uploaded media **Risk Level**: Medium ### Vulnerable Code ```python PUBLIC_BASE_URL = 'http://files.vegamo.cn' ``` ```python def upload(source, kind, frame): if is_online(source): return source path, mime = prepared[(source, kind, frame)] if path in uploaded: return uploaded[path] # Recheck local files immediately before handing them to the SDK. validate_file(path, kind, frame) suffix = mimetypes.guess_extension(mime) or path.suffix.lower() key = UPLOAD_PREFIX + uuid.uuid4().hex + suffix try: body, info = put_file(uptoken, key, str(path), mime_type=mime, check_crc=True) except Exception as exc: # SDK exception messages may contain the upload token. raise VideoError(f'七牛上传失败（{type(exc).__name__}）；未提交生成任务。') from exc if info is None or not info.ok() or not isinstance(body, dict) or body.get('key') != key: raise VideoError('七牛上传失败或响应 key 不匹配；未提交生成任务。') uploaded[path] = PUBLIC_BASE_URL + '/' + quote(key, safe='/') return uploaded[path] ``` ### Technical Analysis After a local media file is uploaded, the script creates its retrieval URL using an `http://` base address. HTTP does not provide transport encryption, server authentication, or integrity protection. The generated object name contains a random UUID, which reduces opportunistic guessing, but the complete URL functions as a bearer-style locator once disclosed. No expiration, signature, access restriction, or deletion lifecycle is implemented in the audited code. The URL is subsequently included in the generation request, causing the remote generation service to retrieve the material through an unencrypted endpoint. An attacker positioned on a network path used for that retrieval could observe the URL and content or ...[truncated 1441 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the plaintext base URL with a verified HTTPS endpoint: ```python PUBLIC_BASE_URL = 'https://files.vegamo.cn' ``` 2. Fail closed if uploaded material cannot be retrieved exclusively through HTTPS; do not silently fall back to HTTP. 3. Use short-lived, cryptographically signed download URLs scoped to one object and the minimum necessary lifetime. 4. Keep uploaded objects private by default rather than relying only on unguessable UUID-based names. 5. Delete uploaded source objects after successful generation, cancellation, or an appropriate failure-retention period. 6. Where supported, bind signed URLs to the generation service or otherwise constrain their audience. 7. Add integration tests verifying HTTPS URL construction, certificate validation, expiration behavior, and post-task object cleanup. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill explicitly instructs reading local files and fetching HTTP(S) media, and executing a Python script that performs network calls, yet it declares no tool scope or allowed-tools restrictions. In a skill ecosystem, this over-broad undeclared capability increases the chance of unintended file access, SSRF-like URL fetching, or misuse by hosts that rely on manifest-declared permissions for sandboxing and user consent.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The document explicitly requires `overall_soundscape` to use English sentences and `non_diegetic_music` to use English sentences. This forces a specific language choice as a general rule, which is a natural-language locale policy violation under the stated criteria because no user choice or justification is provided.

Unpinned Dependencies

Low

Category: Supply Chain
Content: qiniu>=7.13 requests>=2.32
Confidence: 94% confidence
Finding: The dependency specification `qiniu>=7.13` is unpinned, so builds may resolve to different versions over time. This weakens reproducibility and can allow accidental adoption of a vulnerable or breaking upstream release through normal dependency resolution or supply-chain compromise.

Unpinned Dependencies

Low

Category: Supply Chain
Content: qiniu>=7.13 requests>=2.32
Confidence: 98% confidence
Finding: The dependency specification `requests>=2.32` is unpinned, which makes the installed version non-deterministic across environments and deployments. Because `requests` is a security-sensitive HTTP library with a history of advisories, leaving it floating increases the chance of pulling in an affected or unexpected release and makes vulnerability management harder.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The manifest references `requests` without an exact version, while multiple known advisories exist for that package family. Without a pinned version, it is impossible to verify from this file alone whether deployments will use a safe patched release, creating uncertainty around exposure in a component that handles outbound HTTP and potentially credentials.

Static analysis

No suspicious patterns detected.