Security audit

faceless-video-automation

Security checks for vulnerabilities and agentic risk

Overview

The skill’s video workflow is mostly coherent, but it also adds an automatic generic learning system that stores user preferences, error notes, and usage history locally and can steer future behavior.

Review before installing. The video-generation features are not the main issue; the concern is the added local memory system. It can record how the skill is used, store preferences and failure notes, and influence later runs without clear opt-in, retention, or deletion controls. Avoid putting secrets or sensitive details in notes, and consider removing or disabling the learner before use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill claims to perform faceless video automation, but it also introduces a generic cross-skill learning and analytics subsystem that records usage, failures, and user preferences. This hidden expansion of scope undermines user consent and creates an unexpected data collection surface that could be reused beyond the stated video-production purpose.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: Adding a generic self-learning and behavior-tracking module unrelated to the skill's primary function creates unnecessary persistent state and enlarges the attack/privacy surface. Because it is framed as automatic and maintenance-free, users may be unaware that their interactions and error history are being stored over time.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The learner examples reference unrelated capabilities such as resume optimization, showing that the subsystem is generic and not bounded to faceless video workflows. That strongly suggests this skill can be repurposed to log activity across arbitrary tasks, increasing the risk of covert profiling and scope creep.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill omits any clear warning that it stores user preferences, usage history, and error data persistently. Failing to disclose such storage prevents informed consent and may expose sensitive behavioral information, especially when the storage is automatic and not obviously tied to the advertised feature set.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The module writes user preferences and operational history to disk automatically in learned_patterns.json without any user-facing notice, consent flow, retention policy, or minimization controls. In practice, this can silently accumulate behavioral data and sensitive metadata, especially because the skill is marketed for automation and may be run repeatedly in unattended workflows.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Free-form note text is persisted directly to disk and later surfaced in reflection output, with no warning that notes may contain API keys, personal information, internal URLs, or other sensitive content. Because notes are arbitrary strings and likely operator-authored during failures, they are especially prone to capturing secrets or incident details that should not be retained indefinitely.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The instructions explicitly direct persistent storage of user preferences and usage history in a local JSON file, in plain language categories like errors, preferences, and operation counts. Persistent behavioral records can reveal sensitive patterns and are especially risky when retention limits, access controls, minimization, and consent are not defined.

Static analysis

No suspicious patterns detected.