Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent video-editing helper, but it includes unsafe setup and helper-script patterns that deserve review before installation.
Review this before installing. Use a safer uv installation method, avoid running the provided helper scripts with untrusted project names, prompts, ports, or `VEA_DIR` values, protect `~/vea/config.json` with owner-only permissions, and expect video data or derived text/audio requests to reach Memories.ai, Google/Gemini, ElevenLabs, and Soundstripe depending on enabled features.
SKILL.md:14Unverified Remote Installer Is Piped Directly into a Shell
scripts/start_server.sh:5Shell Command Injection Through Unvalidated Server Arguments
references/config.md:3Multiple API Credentials Are Stored Together in a Plaintext Configuration File
The '| sh' pattern is a classic chaining abuse primitive because it converts fetched network content directly into code execution in a single step. In this skill context, where users are instructed to bootstrap tooling for a local agent, the pattern is especially dangerous because it normalizes executing unaudited remote content with the user's privileges.
cd vea-open-source
# Install uv package manager
curl -LsSf https://astral.sh/uv/install.sh | sh
# Install dependencies
uv sync
The skill instructs users to run shell commands, install software, and operate a local server, but it does not declare any explicit tool scope or permission boundaries. This creates an undeclared execution surface where an agent or user may invoke shell actions beyond what is transparently disclosed, increasing the chance of unsafe automation or privilege misuse.
The description says to use the skill for broadly defined tasks like 'any video editing task,' which can cause over-invocation in contexts the user did not specifically intend. Overly broad activation increases the chance an agent routes unrelated or sensitive media-processing requests into a skill that performs local shell, file, and network actions.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| OS | Command |
|----|---------|
| Ubuntu/Debian | `sudo apt install ffmpeg` |
| macOS | `brew install ffmpeg` |
| Windows | Download from ffmpeg.org |
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Before any editing, index the video to enable AI comprehension:
curl -X POST "http://localhost:8000/video-edit/v1/index" \
-H "Content-Type: application/json" \
-d '{"blob_path": "data/videos/PROJECT_NAME/video.mp4"}'
The skill explicitly retrieves content from Soundstripe using an API token, which is a real external transmission path involving credentials and potentially user-selected media metadata. In this skill context, external music retrieval is expected, but it still exposes secrets to shell history/process context and introduces third-party data sharing and supply-chain dependence.
# Download from Soundstripe API
SOUNDSTRIPE_KEY=$(jq -r '.api_keys.SOUNDSTRIPE_KEY' ~/vea/config.json)
curl -s "https://api.soundstripe.com/v1/songs/TRACK_ID" \
-H "Authorization: Token $SOUNDSTRIPE_KEY" | jq '.included[0].attributes.versions.mp3'
# Mix with ffmpeg (15-20% music volume)
The documentation embeds realistic plaintext secret examples and explicitly instructs loading them into environment variables, but provides no warning about secure storage, redaction, or avoiding committing secrets to disk. In an agent skill context, users may copy this pattern directly into local config files or logs, increasing the chance of accidental credential exposure and downstream abuse of paid third-party APIs.
The skill documentation states that video, transcripts, narration, subtitles, and music selection rely on external services, but does not disclose that user media and derived content may be transmitted to third parties. For a video-editing agent handling potentially sensitive recordings, this omission can lead to unintentional privacy, confidentiality, and compliance violations if users assume processing is local.
The script loads SOUNDSTRIPE_KEY from a config file and uses it in a curl request to api.soundstripe.com. While the code logs that it is fetching a track, it does not disclose that a locally stored credential will be used and transmitted to an external service.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Get track download URL
echo "Fetching track $TRACK_ID from Soundstripe..."
TRACK_INFO=$(curl -s "https://api.soundstripe.com/v1/songs/$TRACK_ID" \
-H "accept: application/json" \
-H "Authorization: Token $SOUNDSTRIPE_KEY")
The script invokes ffmpeg with the -y flag, which overwrites the specified output file without confirmation. In an automated agent context, this can silently destroy existing user data or previous outputs if the output path is incorrect, reused, or influenced by another workflow step.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo "VEA already running"
else
echo "Starting VEA..."
cd "$VEA_DIR" && nohup ./.venv/bin/python -m src.app > /tmp/vea.log 2>&1 &
sleep 5
curl -s "$VEA_URL/" | jq . 2>/dev/null && echo "VEA started!" || echo "Failed to start, check /tmp/vea.log"
fi
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
echo "Usage: vea_helper.sh index <project_name>"
exit 1
fi
curl -X POST "$VEA_URL/video-edit/v1/index" \
-H "Content-Type: application/json" \
-d "{\"blob_path\": \"data/videos/$2/\", \"start_fresh\": true}" | jq .
;;
The script interpolates untrusted user input directly into a JSON request body sent to the local VEA service, including the free-form prompt parameter. Because the JSON is constructed by shell string concatenation without escaping, crafted input containing quotes or JSON fragments can break the structure and potentially inject unintended fields or alter request semantics against the local service.
echo "Usage: vea_helper.sh edit <project_name> \"<prompt>\""
exit 1
fi
curl -X POST "$VEA_URL/video-edit/v1/flexible_respond" \
-H "Content-Type: application/json" \
-d "{
\"blob_path\": \"data/videos/$2/\",
Piping a remote script from astral.sh directly into sh executes unverified code from the network without inspection or integrity checking. In a skill that already expects shell access and developer setup, this materially increases supply-chain compromise risk if the remote endpoint, TLS path, or script content is malicious or altered.
cd vea-open-source
# Install uv package manager
curl -LsSf https://astral.sh/uv/install.sh | sh
# Install dependencies
uv sync
This markdown file documents that /flexible_respond produces rendered videos, project files, narration audio, subtitles, and music under data/outputs/PROJECT_NAME/, which are persistent filesystem writes. The documentation does not include any warning or disclosure that invoking the endpoint will create and store multiple output artifacts on disk.
No suspicious patterns detected.