Security audit

TencentCloud Video AIGC Detection

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate Tencent Cloud video-detection purpose, but it asks agents to install an unspecified upload skill and recommends plaintext persistent cloud credentials, so users should review it before installing.

Install only after you are comfortable sending analyzed videos to Tencent Cloud services. Use a reviewed, exact COS upload tool instead of any similarly named skill, pin dependencies in an isolated environment, and prefer short-lived least-privilege Tencent credentials. Do not store static Tencent SecretKeys in shell startup files; if you already did, remove them and rotate the key. Treat the output as a Tencent moderation/AIGC detection signal, not as definitive proof of authenticity.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:116
Finding: Unconstrained Discovery and Installation of an Unverified COS Upload Skill
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:319
Finding: Unpinned Installation of the Tencent Cloud Python SDK
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:62
Finding: Plaintext Persistence of Long-Lived Tencent Cloud Credentials in Shell Startup Configuration
Content: View full analysis
> ~/.zshrc echo 'export TENCENTCLOUD_SECRET_KEY="你的SecretKey"' >> ~/.zshrc echo 'export TENCENTCLOUD_AIGC_RECOG_VIDEO_BIZ_TYPE="你的BizType"' >> ~/.zshrc source ~/.zshrc ``` ### Technical Analysis The optional persistence instructions append the Tencent Cloud Secret ID and Secret Key directly to `~/.zshrc`. This stores long-lived credentials as plaintext and exports them into the environment of every subsequently launched descendant process from that shell. Shell startup files are not dedicated secret stores. They may be copied into backups, included accidentally in support bundles, synchronized between systems, read by other local software with the user's permissions, or disclosed when configuration files are shared. Environment inheritance also exposes the credentials to unrelated processes launched from the shell. Although the scripts support the `TENCENTCLOUD_TOKEN` variable for temporary STS credentials, the persistence example promotes static credential storage instead. ### Attack Path 1. A user follows the persistence instructions and writes static credentials into `~/.zshrc`. 2. The credentials remain on disk and are loaded into future shell environments. 3. Malware, another process running as the same user, an exposed backup, or an accidentally shared configuration repository reads the file or inherited environment. 4. The attacker obtains the Secret ID and Secret Key. 5. The attacker authenticates to Tencent Cloud and performs operations allowed by the associated CAM identity. ### Impact Assessment The attacker receives the cloud permissions assigned to the compromised credentials. Depending on the CAM policy, this may include: - Creating and querying video moderation tasks. - ...[truncated 424 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is presented as a dedicated AI-generated-video authenticity detector, but the described behavior relies on broader Tencent Cloud moderation/task-detail APIs and generalized moderation outputs. This mismatch can mislead users and downstream agents about what assurance the tool actually provides, causing over-trust in results for deepfake/authenticity decisions when the backend may be performing broader content moderation rather than narrowly scoped provenance detection.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs use of sensitive environment variables for cloud credentials but does not declare an explicit tool scope such as permissions or allowed-tools. That increases the chance an agent can access or manipulate secrets more broadly than intended, reducing least-privilege protections and making accidental credential exposure or misuse more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs agents to upload local video files to Tencent Cloud COS and generate a presigned URL before analysis, but it does not provide a clear user-facing warning that local data will be transmitted to remote cloud storage and then to another cloud analysis service. This can lead to unintentional exfiltration of sensitive or regulated video content, especially when users believe they are only performing local analysis.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire skill file is written in Chinese and presents the API reference exclusively in that language, with no indication that users may choose another language or that the skill is intentionally region- or language-restricted. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill manifest says this skill is for TencentCloud Video AIGC Detection, but the referenced API is explicitly documented as creating a '视频内容审核任务' under the Video Moderation product. Although line L027 notes that VIDEO_AIGC is one possible task type, the surrounding documentation describes broader content moderation behavior than the manifest's narrower AIGC-detection purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The reference document is for Tencent Cloud's general 视频内容安全（VM）/内容审核 task-detail API, while the skill is advertised as a Video AIGC Detection capability. This mismatch can cause the agent or operator to call the wrong backend, mis-handle response semantics, or make incorrect trust/safety decisions based on unrelated moderation fields, which is a real security and integrity risk in a detection/review workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This code file contains natural-language strings that force a specific language for errors and guidance. The policy allows fixed locale only when user choice or a justified regional constraint is provided, which is not present here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.