Ai Video Gen

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 3:31 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward AI video-generation helper that uses expected cloud providers, local files, and FFmpeg, with some privacy and hardening caveats.

Install this in a virtual environment, keep provider API keys scoped and private, monitor paid API usage, and avoid sending confidential prompts, scripts, images, audio, or videos unless the providers' data policies are acceptable. Keep FFmpeg and Python dependencies updated, and be careful with unusual image filenames and output paths because FFmpeg is invoked locally and selected outputs may be overwritten.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tainted flow: 'image_url' from os.getenv (line 49, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

# Download image
        img_path = self.output_dir / f"image_{int(time.time())}.png"
        img_data = requests.get(image_url).content
        with open(img_path, 'wb') as f:
            f.write(img_data)

• Confidence: 86% confidence
• Finding: The code downloads a URL returned by an external API without validating the scheme, host, or size of the response. If the upstream service is compromised or returns an unexpected URL, this can enable server-side request forgery behavior or retrieval of malicious/oversized content into local storage.

Tainted flow: 'video_url' from requests.get (line 125, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

# Download video
        video_path = self.output_dir / f"video_{int(time.time())}.mp4"
        video_data = requests.get(video_url).content
        with open(video_path, 'wb') as f:
            f.write(video_data)

• Confidence: 89% confidence
• Finding: The video download URL comes from prior network input and is fetched without any validation or download limits. A malicious or compromised API response could redirect the tool to fetch arbitrary internal or external resources, or large files that cause resource exhaustion.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation describes capabilities that require environment-variable access, network access, file writing, and shell/FFmpeg execution, but it does not declare permissions. This creates a transparency and governance gap: users or platforms may authorize or run a skill without understanding that it can access API keys, send data externally, and invoke local tooling.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to configure API keys and use multiple third-party AI providers, and it discusses pricing, but it does not clearly warn that prompts, images, narration text, and possibly other generated media will be transmitted to external services and may incur charges. In a skill designed for end-to-end AI video generation, this omission is materially important because users may submit sensitive content or unknowingly trigger paid API usage across several vendors.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly integrates with multiple third-party AI providers for image generation, video generation, and voice-over, yet it does not warn users that prompts, images, audio, and generated media may be transmitted to external services. In this context, that omission is significant because users may submit sensitive creative content, personal voice text, or private media without informed consent about external processing and retention.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: User-provided text is sent to OpenAI's TTS API, which transmits potentially sensitive content to an external service. The code does not provide an explicit warning, consent prompt, or privacy notice at the point of use, so users may unintentionally disclose confidential information.

Unvalidated Output Injection

High

• Category: Output Handling

Content

output_path
        ]
        
        result = subprocess.run(cmd, capture_output=True, text=True)
        
        if result.returncode != 0:
            raise Exception(f"FFmpeg error: {result.stderr}")

• Confidence: 83% confidence
• Finding: The script passes externally sourced media files into FFmpeg without validating the files, constraining resource usage, or sandboxing the processing step. Because FFmpeg is a large native parser with a history of media parsing flaws, processing attacker-controlled content can expose the host to denial of service or parser-level exploitation if a vulnerable FFmpeg build is present.

Unvalidated Output Injection

High

• Category: Output Handling

Content

]
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, check=True)
        print(f"✅ Video created: {output_path}")
        return output_path
    except subprocess.CalledProcessError as e:

• Confidence: 86% confidence
• Finding: The code writes attacker-controlled image paths into an FFmpeg concat demuxer file and runs FFmpeg with '-safe 0', explicitly disabling path safety checks. Because the file list format uses single-quoted paths without escaping embedded quotes or special characters, a crafted filename can inject additional concat directives or alter FFmpeg's interpretation of inputs, potentially causing unintended file access or processing of attacker-chosen resources.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
replicate>=0.20.0
requests>=2.31.0
pillow>=10.0.0

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens reproducibility and can unintentionally pull in newly introduced vulnerable or breaking releases, increasing supply-chain risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
replicate>=0.20.0
requests>=2.31.0
pillow>=10.0.0
python-dotenv>=1.0.0

• Confidence: 93% confidence
• Finding: Using an unpinned version range for replicate means builds are not deterministic and may silently consume newer upstream releases. In a skill that depends on multiple external AI services, this increases supply-chain exposure and the chance of introducing vulnerable code during deployment.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
replicate>=0.20.0
requests>=2.31.0
pillow>=10.0.0
python-dotenv>=1.0.0

• Confidence: 95% confidence
• Finding: The requests package is unpinned, so installations may resolve to varying versions depending on timing and index state. Because this skill likely performs network operations against external APIs, uncontrolled upgrades can directly affect transport security behavior and may introduce exploitable vulnerable versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.0.0
replicate>=0.20.0
requests>=2.31.0
pillow>=10.0.0
python-dotenv>=1.0.0

• Confidence: 97% confidence
• Finding: Pillow is unpinned, which is especially risky because image-processing libraries have a long history of memory-safety and parsing vulnerabilities. In an AI video generation skill that likely handles untrusted images and media, silent version drift can expose the environment to serious parser bugs or even code execution paths.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

replicate>=0.20.0
requests>=2.31.0
pillow>=10.0.0
python-dotenv>=1.0.0

• Confidence: 90% confidence
• Finding: An unpinned python-dotenv dependency permits non-reproducible installs and can pull in versions with newly disclosed flaws. While typically lower impact than network or media libraries, it still contributes to avoidable supply-chain risk.

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The finding indicates requests 2.31.0 is affected by multiple advisories, including credential leakage via malicious URLs and request/session verification issues. Since this skill likely communicates with external AI providers over HTTP(S), a vulnerable requests version can expose API tokens, alter trust guarantees, or otherwise weaken outbound request security.

Known Vulnerable Dependency: pillow==10.0.0 — 10 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2023-4863 (libwebp: OOB write in BuildHuffmanTable) +7 more

Critical

• Category: Supply Chain
• Confidence: 99% confidence
• Finding: Pillow 10.0.0 is flagged with multiple serious advisories, including code execution and buffer-overflow-class issues in image parsing components. This is especially dangerous in a video-generation skill that processes images or user-supplied media, because crafted inputs could trigger parser vulnerabilities during normal operation.

Known Vulnerable Dependency: python-dotenv==1.0.0 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: python-dotenv 1.0.0 is reported as affected by a symlink-following issue in set_key that can lead to arbitrary file overwrite in certain usage patterns. The impact depends on whether this skill actually invokes the vulnerable function on attacker-influenced paths, but the dependency is still a genuine risk that should be patched.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.