Security audit

alibabacloud-video-prompt-architect

Security checks for vulnerabilities and agentic risk

Overview

This is a prompt-writing helper with no executable code, network actions, credential handling, or hidden destructive behavior, though it does ask agents to reuse low-sensitivity style preferences.

Installers should expect a prompt-generation assistant that may force model-specific prompt languages and may reuse simple style/model preferences if the host agent has memory. Avoid using it with sensitive unreleased campaign details if persistent memory is enabled and you do not want those preferences carried forward.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (24)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 378)May include surrounding context.
md
## Generation Rules 1. **Language Rules (MANDATORY)**: - **Chinese-first models**: Happy Horse, Seedance, Kling, Wanx, Hailuo, seedream, Qwen Image — **MUST output Prompts in Chinese**. The Positive Prompt and Negative Prompt code blocks MUST contain Chinese text. English-only output for these models is a critical error. - **English-first models**: Veo, Sora, Runway, Pika, Nano Banana, GPT Image, Grok Image, Midjourney, FLUX, Ideogram, Recraft — **MUST output Prompts in English**. The Positive Prompt and Negative Prompt code blocks MUST contain English text. Chinese-only output for these models is a critical error. - **Creative Analysis table content** MUST match the target model's language: Chinese-first models use Chinese descriptions in the Creative Analysis table; English-first models use English descriptions. - Explanatory notes (metadata, section headers, labels) always use Chinese

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 379)May include surrounding context.
md
## Generation Rules 1. **Language Rules (MANDATORY)**: - **Chinese-first models**: Happy Horse, Seedance, Kling, Wanx, Hailuo, seedream, Qwen Image — **MUST output Prompts in Chinese**. The Positive Prompt and Negative Prompt code blocks MUST contain Chinese text. English-only output for these models is a critical error. - **English-first models**: Veo, Sora, Runway, Pika, Nano Banana, GPT Image, Grok Image, Midjourney, FLUX, Ideogram, Recraft — **MUST output Prompts in English**. The Positive Prompt and Negative Prompt code blocks MUST contain English text. Chinese-only output for these models is a critical error. - **Creative Analysis table content** MUST match the target model's language: Chinese-first models use Chinese descriptions in the Creative Analysis table; English-first models use English descriptions. - Explanatory notes (metadata, section headers, labels) always use Chinese

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: These lines prescribe mandatory language behavior based on model family rather than user preference, and line L072 further requires explanatory notes to always be in Chinese. That is a natural-language locale policy violation because it enforces a specific language without documenting user choice or justified regional scope.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · references/acceptance-criteria.md (reported line 228)May include surrounding context.
md
- Negative prompt does not contradict positive description #### ❌ INCORRECT - Output Prompt contains unresolved semantic conflicts between components - Length exceeds model limit without trimming - Negative prompt contradicts positive description - Physically implausible descriptions (e.g., human hovering motionless for 30 seconds, defying gravity) pass through without correction

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation repeatedly marks several models as 'Chinese (mandatory)' and later requires prompts for those models to 'MUST output Prompts in Chinese.' This is a natural-language locale policy constraint that does not offer the user an opt-in or alternative, so it forces a language choice rather than presenting it as a user-controlled option.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instruction 'Explanatory notes (metadata, section headers, labels) always use Chinese' imposes a fixed language for surrounding output even when the user may prefer another language. This is an explicit locale policy in natural language and does not provide user choice or opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly tells the agent to remember and automatically apply user preferences in later interactions, which introduces stateful behavior and retention beyond the core prompt-generation function. If implemented without explicit consent, scoping, and retention controls, this can cause unintended storage and reuse of user-provided data across sessions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions to remember and reuse user preferences across sessions create a natural-language data retention mechanism without specifying consent, storage boundaries, or deletion controls. Even if the data seems low sensitivity, repeated retention can profile user behavior and leak prior context into future sessions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Repeated encouragement to remember user behavior and proactively set defaults normalizes continuous collection of user-derived data beyond immediate task fulfillment. In a shared or enterprise environment, such behavior can accumulate profile data and create privacy, compliance, and context-leak risks.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/acceptance-criteria.md (reported line 146)May include surrounding context.
md
- Supports modifying a single component and regenerating #### ❌ INCORRECT - Generates directly for any input without confirmation - Regenerates everything when user requests modification to one component - Does not provide selectable generation modes

Unbounded Output

Medium

Category: Output Handling
Confidence: 60% confidence
Finding: Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
Content: Scanner excerpt · references/acceptance-criteria.md (reported line 229)May include surrounding context.
md
#### ❌ INCORRECT - Output Prompt contains unresolved semantic conflicts between components - Length exceeds model limit without trimming - Negative prompt contradicts positive description - Physically implausible descriptions (e.g., human hovering motionless for 30 seconds, defying gravity) pass through without correction - Physical plausibility correction applied silently without ⚠️ Note to inform user

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file explicitly sets "Language: English" for Veo in Example 3 even though the user input is in Chinese, indicating a forced language choice rather than preserving or offering the user's preferred language. This is a natural-language locale policy issue because the skill appears to require a specific output language without user opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Example 4 labels GPT Image output as "Language: English" despite the user input being Chinese, and the same pattern appears throughout the file for other tools. This indicates a policy-relevant language constraint embedded in the skill examples rather than a user-selected preference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The guidance states that prompt code blocks "MUST be in Chinese" and that English-only output is a critical error. This is a natural-language locale policy constraint presented as mandatory behavior, with no indication of user choice or opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This line requires prompt code blocks to be in Chinese and frames Chinese as mandatory rather than optional. That forces a specific language/locale without offering user selection or noting a justified regional limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction says prompts "MUST be in Chinese," which is a hard language requirement in natural-language guidance. No alternative language path, user preference handling, or documented justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guidance requires prompt code blocks to be in Chinese, which enforces a specific language policy. The file does not indicate that users can opt in to this constraint or choose another locale.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The wording makes Chinese mandatory for prompt code blocks, creating a fixed language requirement. There is no user choice, opt-in, or clearly documented regional justification alongside the requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This instruction mandates Chinese for prompt code blocks, which is a locale policy constraint in the documentation. The file does not offer a user-controlled language choice or explain the restriction as a justified regional requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The heading "HappyHorse Chinese Template (Recommended)" presents a preferred language-specific template, which can amount to forcing a specific language/locale in skill guidance. The file does not indicate that users may choose another language or that the Chinese-only recommendation is required for a region-specific or model-specific compliance reason.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 399)May include surrounding context.
md
- Conservative: Faithful to user's original description, compact structure, no extra divergence - Creative: Diverge from the original, add artistic expressions and unexpected elements - Minimal: Shortest effective Prompt, retain only core elements, test model comprehension 10. **Strict Prohibition After Final Prompt**: After `### ✅ Final Prompt` (or `### ✅ Shot Prompts (copy-ready)` in multi-shot mode), **NO additional content is allowed**. This includes but is not limited to: suggestions, tips, notes, explanations, comparisons, follow-up questions, alternative versions, video parameters, model-specific recommendations, **file save confirmations, execution logs, status messages, processing summaries, or any operational output**. The prompt code blocks MUST be the absolute last content in the output. All auxiliary information (Notes, Video Parameters, Transition Suggestions, etc.) must appear BEFORE the Final Prompt section. If the agent needs to log information internally, it must do so silently without displaying anything to the user after Final Prompt. ---

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file specifies "Language: Chinese" for Seedance as a fixed mode, which can constitute a locale policy issue when the skill does not indicate that the user may choose another language. Even if model-specific, the constraint is not justified in the surrounding text.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The example hard-codes "Language: Chinese" as the output mode. Because the file does not explain that this is a necessary model limitation or offer a language choice, it may violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown example fixes the output language to Chinese rather than describing language behavior as user-selectable. The lack of opt-in or justification makes this a natural-language policy concern under the language/locale rule.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.