Sense Audio

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:44 AM UTC
• Version: 1.0.0

Overview

This is a straightforward SenseAudio API integration guide; it involves sending media and API credentials to SenseAudio as expected, with no hidden execution or persistence.

Before installing or using this skill, understand that generated examples may send text, audio, video, prompts, identifiers, and API credentials to SenseAudio services. Use environment variables or secret management for API keys, avoid logging raw media or tokens, and add user consent, privacy notice, and retention controls when building production ASR or media-upload features.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (16)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The reference documents sending audio and API credentials to a third-party service but provides no user-facing notice about privacy, consent, or handling of potentially sensitive voice data. In the context of an integration guide, this omission can cause downstream implementations to transmit personal or confidential audio without adequate disclosure or policy controls.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The records section notes retention up to 7 days but does not clearly warn that transcription records are stored server-side and may remain accessible through query APIs. This creates a privacy and compliance risk because integrators may unknowingly build features that expose or rely on retained user speech data without disclosure or lifecycle controls.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Endpoint Summary

- Create video task: `POST https://api.senseaudio.cn/v1/video/create`
- Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>`
- Upload media: `POST https://api.senseaudio.cn/v1/video/upload`
- Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Endpoint Summary

- Create video task: `POST https://api.senseaudio.cn/v1/video/create`
- Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>`
- Upload media: `POST https://api.senseaudio.cn/v1/video/upload`
- Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Endpoint Summary

- Create video task: `POST https://api.senseaudio.cn/v1/video/create`
- Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>`
- Upload media: `POST https://api.senseaudio.cn/v1/video/upload`
- Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Endpoint Summary

- Create video task: `POST https://api.senseaudio.cn/v1/video/create`
- Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>`
- Upload media: `POST https://api.senseaudio.cn/v1/video/upload`
- Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Endpoint Summary

- Create video task: `POST https://api.senseaudio.cn/v1/video/create`
- Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>`
- Upload media: `POST https://api.senseaudio.cn/v1/video/upload`
- Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Endpoint Summary

- Create video task: `POST https://api.senseaudio.cn/v1/video/create`
- Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>`
- Upload media: `POST https://api.senseaudio.cn/v1/video/upload`
- Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Endpoint Summary

- Create video task: `POST https://api.senseaudio.cn/v1/video/create`
- Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>`
- Upload media: `POST https://api.senseaudio.cn/v1/video/upload`
- Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Endpoint Summary

- Create video task: `POST https://api.senseaudio.cn/v1/video/create`
- Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>`
- Upload media: `POST https://api.senseaudio.cn/v1/video/upload`
- Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Endpoint Summary

- Create video task: `POST https://api.senseaudio.cn/v1/video/create`
- Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>`
- Upload media: `POST https://api.senseaudio.cn/v1/video/upload`
- Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Endpoint Summary

- Create video task: `POST https://api.senseaudio.cn/v1/video/create`
- Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>`
- Upload media: `POST https://api.senseaudio.cn/v1/video/upload`
- Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Endpoint Summary

- Create video task: `POST https://api.senseaudio.cn/v1/video/create`
- Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>`
- Upload media: `POST https://api.senseaudio.cn/v1/video/upload`
- Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Endpoint Summary

- Create video task: `POST https://api.senseaudio.cn/v1/video/create`
- Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>`
- Upload media: `POST https://api.senseaudio.cn/v1/video/upload`
- Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Endpoint Summary

- Create video task: `POST https://api.senseaudio.cn/v1/video/create`
- Query task status: `GET https://api.senseaudio.cn/v1/video/status?id=<task_id>`
- Upload media: `POST https://api.senseaudio.cn/v1/video/upload`
- Create storyboard: `POST https://api.senseaudio.cn/v1/video/storyboard/create`

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This markdown file instructs use of an `Authorization: Bearer <API_KEY>` header but does not include any caution about safeguarding API keys or avoiding accidental disclosure in logs, examples, or shared code. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors affecting privacy or system integrity, and credential handling falls into that scope.

Static analysis

No suspicious patterns detected.