veo-3.1

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:51 AM UTC
• Version: 0.2.10

Overview

This skill is a disclosed RunAPI/Veo video-generation workflow, with the main caution that it installs and uses an unpinned third-party CLI.

Install this only if you are comfortable trusting the RunAPI Homebrew tap and CLI with your RunAPI authentication state, selected local media files, generated outputs, and potentially billable Veo jobs. Prefer reviewing the CLI source/release provenance or pinning a known version where your environment allows it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–17
Vulnerability Type: Supply-chain risk from an unpinned executable dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
- kind: brew
  formula: runapi-ai/tap/runapi
  bins:
  - runapi

Technical Analysis

The skill instructs the environment to install the runapi executable from the third-party Homebrew tap runapi-ai/tap without specifying an immutable version, formula revision, checksum, signature, or source commit.

The installed CLI occupies a security-sensitive position: subsequent instructions allow it to process authentication material, read local media paths, upload user content, submit potentially billable jobs, and download results. Because the dependency is mutable and lacks an integrity constraint, a compromise of the tap, formula, release artifact, or publisher account could cause later installations to execute code that differs from the version originally audited.

This is a supply-chain exposure rather than evidence that the current runapi package is malicious. The reviewed file contains no embedded malicious scripts, hardcoded credentials, persistence mechanism, or command that directly downloads remote content and pipes it into a shell.

Attack Path

1. An attacker compromises the third-party Homebrew tap, its release infrastructure, or an associated publisher account.
2. The attacker modifies the mutable runapi formula or referenced binary artifact.
3. An agent follows the skill metadata and installs runapi-ai/tap/runapi without enforcing an audited version or artifact digest.
4. The substituted executable runs with the privileges of the invoking user.
5. During normal skill use, the executable receives access to authentication state and local media selected for upload.
6. The compromised executable could read accessible files, disclose credentials or media, alter requests, initiate unauthori ...[truncated 701 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a reviewed, explicit version rather than installing the latest mutable release.
2. Pin the Homebrew formula or tap to an immutable source revision where the installation framework permits it.
3. Verify the downloaded artifact using a publisher-provided cryptographic checksum or signature before execution.
4. Document the expected package source, version, signing identity, and digest in the skill metadata or installation procedure.
5. Require explicit user approval before installing or upgrading the executable.
6. Run the CLI with least privilege and restrict its filesystem and environment access to the media and credentials required for the current task.
7. Re-audit dependency updates before changing the pinned version, including verification of the formula and upstream release provenance.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.