T09 · Insecure Skill Coding Practices
Error
- Location
auto_video_generator/template_manager.py:445- Finding
Arbitrary Filesystem Write Through Unsafe Template Archive Extraction
- Content
View full analysis
- Remediation
View remediation
Security audit
auto-video-generator
Security checks for vulnerabilities and agentic risk
Overview
This skill is presented as a production video generator, but the inspected artifacts show simulated outputs plus several high-impact local and network exposure risks that need review before installation.
Review this package carefully before installing. Treat it as unfinished or prototype-grade despite production claims, avoid running the web UI on a reachable network, do not install untrusted template archives, and do not use the VS Code extension until the external script path and environment handling are fixed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T07 · Tool Hijacking and Spoofing
Error
- Location
vscode-extension/src/videoGenerator.ts:150- Finding
Unverified External Python Script Execution With Full Environment Inheritance
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
web-ui/app.py:25- Finding
Unauthenticated Network-Exposed Web Interface With Wildcard Cross-Origin Access
- Content
View full analysis
', methods=['GET']) def get_task_status(task_id: str): task = task_manager.get_task(task_id) if not task: return jsonify({ 'success': False, 'error': 'Task not found' }), 404 return jsonify({ 'success': True, 'data': task }) ``` WebSocket subscribers can likewise retrieve task objects without identity or ownership checks: ```python @socketio.on('subscribe_task') def handle_subscribe(data): """Subscribe to updates for a specific task.""" task_id = data.get('task_id') if task_id: task = task_manager.get_task(task_id) if task: emit('task_update', task) ``` ### Technical Analysis The application combines several unsafe access-control decisions: - It binds to `0.0.0.0`, making the service reachable through every available network interface. - It does not implement authentication for HTTP routes or WebSocket connections. - `CORS(app)` permits broad cross-origin HTTP access. - `cors_allowed_origins="*"` permits WebSocket connections from arbitrary origins. - Any client can create generation jobs. - Any client that knows or discovers a task ID can retrie ...[truncated 2606 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (125)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description emphasizes a specific architecture and capabilities: Playwright-based recording, PM-driven scenario decomposition, and bmad-agent-pm integration. The actual supplied code chunk is just an init.py exporting package components and containing a docstring for a more general auto video generator with narration, UI detection, CLI, and web UI. Based on the visible code, the primary domain is still video generation, but the claimed specialized features are not evidenced and the described behavior differs materially from the declared purpose. This is therefore a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description describes a feature-rich video generation skill with recording and intelligent scenario decomposition. The supplied code chunk contains only a minimal adapter module that imports and re-exports AdapterFactory. There is no evidence in this code of video generation, Playwright usage, recording, PM orchestration, or region-aware behavior. This is a materially different primary purpose from the declared description, so it should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The description claims a specialized, real demo video generation system with Playwright-based recording, PM-agent integration, intelligent scenario decomposition, and region-aware recording. This code chunk does not implement those core capabilities. The generate command only displays staged progress and success messages with sleep calls; it does not show actual browser automation, recording, decomposition, or video/audio production. The detect command returns mocked detection data rather than analyzing a project. Separately, the code includes broader CLI/project-management features such as init, config, web, and version that are not reflected in the declared purpose. Therefore the declared description materially overstates and misrepresents the behavior shown in the supplied code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a feature-rich video generation/recording skill, but the supplied code chunk does not implement or invoke any video generation, recording, Playwright automation, scenario decomposition, or PM-agent integration. It merely re-exports configuration management functions from another module. This is a materially different primary purpose from the declared behavior, so it should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description centers on automated demo video production and recording-related capabilities. However, the supplied code chunk does not implement or expose any video generation logic, recording workflow, Playwright usage, scenario decomposition, or PM-agent integration. It only re-exports an EnvironmentDetector class, indicating environment detection functionality. This is a materially different primary purpose from the declared description, so it should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description promises a concrete implementation centered on Playwright-native recording and PM-agent-driven intelligent scenario decomposition with region-aware recording. The supplied code does not show those capabilities. Instead, it provides a wrapper/API with placeholder async sleeps, a stub environment detection hook, a simulated frame count, a stub audio duration, and creation of an empty output file. The primary theme is related to video generation, so this is not unrelated functionality, but the claimed major capabilities are materially unsupported by the code chunk. Therefore the description does not accurately represent actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description emphasizes a sophisticated demo video generation pipeline centered on Playwright recording and PM-agent integration. This code chunk does not implement those capabilities. Instead, it manages template files on disk, parses YAML metadata, renders HTML placeholders, previews templates, validates template structure, computes template statistics, and can export/install template packages. Although it includes a convenience method intended to invoke a VideoGenerator, even that is secondary to template handling and does not show Playwright use, region-aware recording, or PM decomposition. Therefore the declared description materially misrepresents the actual behavior of this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The supplied code chunk does not implement demo video generation or any of the specialized capabilities named in the description. Its actual purpose is limited to starting a Flask-based web UI server and handling missing dependencies. While a web UI could be a supporting component of a larger video generator, this chunk itself is materially different from the declared purpose and lacks the advertised recording, decomposition, and integration behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about intelligent demo video production, but the supplied code is exclusively a documentation synchronization utility. It reads markdown files from predefined EN/ZH paths, compares file existence, size, and section counts, prints reports/statistics, and writes a translation template. There is no evidence of video creation, browser control, recording, scenario planning, or any related media-processing behavior. This is a clear material mismatch in primary purpose and capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description focuses on a video-generation skill with advanced recording and PM-agent orchestration capabilities. This code chunk does not implement video generation or recording itself; instead, it provides a VS Code sidebar/webview for configuring options and dispatching extension commands such as generateVideo and detectEnvironment. While some settings reference video, audio, and recording, the primary purpose of the supplied code is UI/configuration management, not actual demo video production. The advertised features—Playwright native recording, PM-driven scenario decomposition, region-aware recording, and bmad-agent-pm integration—are not present in this chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about intelligent demo video production with Playwright-based recording. The supplied code does something entirely different: it reads package.json and source files from the open VS Code workspace, detects frontend frameworks and UI libraries, searches for auth and layout patterns, and outputs an environment report. This is a materially different primary purpose and includes undeclared codebase scanning capabilities. Therefore the description does not accurately represent the code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The declared description emphasizes a specific intelligent demo-video generation system built around Playwright native recording, PM-style scenario decomposition, region-aware recording, and bmad-agent-pm integration. The supplied code chunk instead mainly implements VS Code extension scaffolding and user interface features: command registration, a config panel webview, status bar controls, environment detection reporting, performance dashboard access, config template export, and welcome/help messaging. While video generation commands are present, the claimed specialized mechanisms are not evidenced in this code. Additionally, the code performs notable extra functions—environment detection, dashboard display, config export, and opening docs—that are not mentioned in the declared purpose. This is a material description/behavior mismatch for this chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description centers on generating real demo videos with Playwright-native recording and intelligent scenario decomposition. The supplied code does none of that. It creates a VS Code webview panel titled 'AVG Performance Dashboard', simulates metrics with random data, updates the UI every two seconds, handles refresh/export/clear commands, and writes exported JSON metrics to a user-selected file. While the mock metrics reference video-generation concepts, they are only simulated dashboard data and not actual recording or generation behavior. This is a materially different primary purpose, and it also includes an undeclared file export capability.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description presents a sophisticated video-generation skill with concrete production capabilities and integrations. This code chunk instead implements a browser-accessible Flask app with REST endpoints and WebSocket updates for configuration, file upload, task tracking, template listing, stats, preview/download, and a mocked background task. The generator function explicitly states it simulates video generation and only emits staged progress before touching an empty .mp4 file. There is no evidence of real recording, Playwright, scenario decomposition, PM-agent orchestration, or region-aware capture. While a web UI could support such a skill, the declared description materially overstates what this code actually does, so this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code chunk is strictly client-side web UI logic: state management, file upload validation, API calls (/api/upload, /api/generate, /api/templates, /api/tasks), socket subscriptions for progress updates, and preview/download/history UI. While it is consistent with a generic video-generation interface, it does not itself implement or demonstrate the specifically declared capabilities such as Playwright recording, scenario decomposition, region-aware recording, or bmad-agent-pm integration. Because the declared description emphasizes those specialized behaviors as the skill’s purpose, but the supplied code only shows a general frontend wrapper around backend services, the description is not accurately represented by this code chunk.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The generate path presents simulated progress and a success message for video creation, but it does not perform generation or write the advertised output. In a tool marketed for professional demo-video production, this is deceptive behavior that can mislead users, downstream automation, and CI pipelines into trusting nonexistent artifacts.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill metadata and CLI behavior imply real Playwright/native recording and intelligent production, but the code only simulates stages and completion. This mismatch is dangerous because users may integrate the tool into workflows expecting genuine media generation and artifact integrity when none exists.
- Content
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
python Args: host: Host to bind to (default: 0.0.0.0) port: Port to listen on (default: 5000) debug: Enable debug mode """ try: import flask
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
python Args: host: Host to bind to (default: 0.0.0.0) port: Port to listen on (default: 5000) debug: Enable debug mode """ try: import flask
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </style> </head> <body> <!-- Navigation --> <nav class="navbar"> <a href="#" class="logo">SaaSPro</a>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </section> <!-- Trusted By --> <section class="trusted-by"> <h3>Trusted by industry leaders worldwide</h3> <div class="logos">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </section> <!-- CTA Section --> <section class="cta" id="contact"> <h2>Ready to Transform Your Workflow?</h2> <p>Join thousands of teams already using SaaSPro to build better products faster. Start your free trial today.</p>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </head> <body> <div class="app-container"> <!-- Sidebar --> <aside class="sidebar"> <div class="bank-logo"> <h1>🏦 SecureBank</h1>
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The examples explicitly encourage processing
http://localhost:3000/adminandfile:///path/to/demo.htmlwithout any warning about the risks of accessing local services or files from the user's environment. In context, the tool is designed to render and record content, so this can directly expose admin interfaces, development environments, secrets in local pages, or sensitive files through captured output.- Content
Known Vulnerable Dependency: Flask==3.0.0 — 2 advisory(ies): GHSA-68rp-wp8r-4726; PYSEC-2026-2151
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The requirements file pins Flask to a version flagged by multiple high-severity advisories, so deploying this web UI with that version likely exposes known, publicly documented weaknesses. In a network-facing Flask application used for file uploads and interactive video-generation workflows, framework vulnerabilities can directly increase risk of request-handling abuse, data exposure, or remote compromise depending on the advisory details.
- Content
Static analysis
No suspicious patterns detected.