Security audit

video-creator-assistant

Security checks for vulnerabilities and agentic risk

Overview

The video assistant mostly matches its stated creative purpose, but it adds an automatic, persistent self-learning system that records usage, preferences, errors, and can rewrite the skill without clear user consent or tight scope.

Review this skill before installing if you do not want an assistant to keep local memory of your usage, preferences, errors, or notes. The video features themselves are normal, but the self-learning module should ideally be disabled, made opt-in, scoped to video-only fields, and given clear inspect/delete controls.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill is presented as a video-creation assistant, but it also embeds a generic self-learning subsystem that records usage history, errors, and user preferences to persistent storage. That hidden secondary behavior expands data collection beyond the stated purpose, undermines informed consent, and creates an unnecessary privacy and integrity risk surface.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: A generic self-learning and behavior-tracking module is unrelated to the skill's stated video-creation function and introduces persistent telemetry-like behavior. Because it can modify local files and accumulate operational history over time, it increases the chance of storing sensitive user context or creating an audit trail users did not expect.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The module explicitly persists user preferences, usage history, error notes, and recent operations to a file in the skill directory. For a video-creation assistant, this creates unnecessary retention of potentially sensitive behavioral data beyond the advertised function, increasing privacy and data-exposure risk if the skill directory is accessed by other local users, bundled, synced, or exfiltrated.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: This code provides cross-skill tracking and preference persistence via arbitrary skill paths, making it a generic telemetry component rather than a narrowly scoped video tool. That broader capability increases the blast radius: other skills can invoke it to create local per-skill dossiers of user activity and notes without clear isolation, access control, or purpose limitation.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: Overly broad trigger phrases can cause the skill to activate in contexts where the user did not intend to use it. In this skill, accidental invocation is more concerning because the skill also includes web access and documented persistent learning behavior, increasing the chance of unnecessary data handling or side effects.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The documentation says the skill automatically writes learning data and user preferences, but it does not clearly warn users that their data will be persisted locally. Lack of transparent notice and consent for storage is a privacy issue, especially when free-form error notes and preferences may contain sensitive natural-language content.

Ssd 3

Medium

Confidence: 97% confidence
Finding: Persistently storing user preferences, usage history, errors, and notes in a local JSON file creates a natural-language data retention risk. Such files can accumulate sensitive context over time, may be readable by other processes or users depending on environment configuration, and are especially risky because the notes field can capture arbitrary user content.

Static analysis

No suspicious patterns detected.