Viral Video Analysis

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:01 PM UTC
• Version: 1.0.1

Overview

The skill is related to video-ad coaching, but its real behavior is narrower than advertised and it sends video URLs to a third-party API.

Install only if you are comfortable sending video URLs to Memories.ai and treating the output as lightweight transcript/ROI coaching rather than full visual ad analysis. Avoid using unpublished, client-confidential, or highly sensitive campaign URLs unless that third-party processing is acceptable, and install dependencies in an isolated environment with pinned versions where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:11

Finding

Unpinned Third-Party Dependency Installation Guidance

Content

View full analysis

Remediation

View remediation

pandas== openpyxl== ``` 2. Generate and record cryptographic hashes for all direct and transitive dependencies, then install them with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Use a lock-file workflow such as `pip-tools`, Poetry, or another reproducible dependency manager to control transitive versions. 4. Run automated dependency vulnerability and integrity checks in CI, using tools such as `pip-audit`, and review dependency updates before merging them. 5. Install dependencies inside an isolated virtual environment under a non-privileged account. Do not recommend system-wide or elevated `pip` installation. 6. Correct `SKILL.md` to state that the script detects missing dependencies and prints manual installation instructions; it does not automatically install packages. 7. Prefer a controlled package index and explicitly document the trusted source used for dependency resolution. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tainted flow: 'HEADERS' from os.environ.get (line 20, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/analyze_video.py (reported line 50)May include surrounding context.

python

return {"error": "Platform not supported (Facebook)"}
    
    try:
        resp = requests.post(
            f"{BASE_URL}/{platform}/video/transcript",
            headers=HEADERS,
            json={"video_url": video_url, "channel": "rapid"},

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description significantly overstates the skill’s functionality. The code’s core behavior is a transcript-length heuristic: it calls an external API to fetch a transcript, counts words, assigns GOOD/OK/BAD based on thresholds, and emits stock feedback about reducing spoken words. It does not inspect visuals, does not ingest or analyze performance metrics, and does not perform substantive ad-performance analysis, ROI comparison, or structural diagnosis beyond word count. While the broad social platforms mostly align, the primary purpose in practice is much narrower than declared. There is also an extra undeclared batch Excel-analysis feature, though the main issue is that the implemented behavior is materially less capable than the description claims.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description promises a substantive video ad analysis capability combining audio transcripts, visual analysis, and performance metrics to explain underperformance and coach creators. The supplied code does not inspect videos, transcripts, or social platform content at all. It reads spreadsheet columns like creator, ad_spend, earnings, and roi, computes simple aggregates/groupings, and inserts fixed findings, thresholds, and feedback text into a PDF. While the output topic is related to video performance, the implemented behavior is materially narrower and different: report generation from existing tabular data rather than multimodal analysis of ad creatives. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill uses environment secrets and makes outbound network requests, but it does not declare an explicit tool/permission scope. That weakens least-privilege controls and makes it harder for a runtime or reviewer to understand what capabilities the skill actually needs before execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description says to use the skill when asked to 'give creator coaching feedback,' 'compare high vs low ROI content,' or 'identify video structure issues' without narrowing the context to ad-performance analysis only. These are broad, natural phrases that could match ordinary conversations and cause unintended invocation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The skill sends user-supplied video URLs and an API key-authenticated request to an external third-party service. Even though the transfer is part of the advertised functionality, it creates data-exposure risk because URLs, associated metadata, and potentially sensitive creator/workflow information leave the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

HEADERS = {"Authorization": API_KEY}

def get_transcript(url: str, platform: str = "instagram"):
    resp = requests.post(
        f"{BASE_URL}/{platform}/video/transcript",
        headers=HEADERS,
        json={"video_url": url, "channel": "rapid"},

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The listed commands include broad phrases like 'Compare these videos' and 'Give me feedback for [creator]' that do not specify platform, ad-analysis context, or required inputs. Without exclusions or narrower phrasing, these triggers could collide with many everyday requests unrelated to this specific skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module documentation overstates the capability as full video and performance analysis, while the logic only evaluates transcript length. Overclaiming functionality creates deceptive trust boundaries: users may expose content or rely on output for creator/business decisions under false assumptions about what was actually analyzed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description claims multimodal and performance-metric analysis, but the implementation only fetches a transcript and scores word count. This mismatch can mislead users into sharing business-sensitive videos or making decisions based on a much more limited analysis than advertised, which is a security-relevant trust and transparency issue.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This code performs external transmission of user-provided video identifiers to a third-party service. While external API calls are expected for this tool, the transmission is security-relevant because it can disclose sensitive campaign, customer, or unpublished media metadata outside the local environment.

Content

Scanner excerpt · scripts/analyze_video.py (reported line 50)May include surrounding context.

python

return {"error": "Platform not supported (Facebook)"}
    
    try:
        resp = requests.post(
            f"{BASE_URL}/{platform}/video/transcript",
            headers=HEADERS,
            json={"video_url": video_url, "channel": "rapid"},

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends user-supplied video URLs to an external API and receives transcript data without any runtime disclosure or consent prompt. In this skill context, creators may analyze unpublished, proprietary, or client content, so silent third-party transmission increases privacy, confidentiality, and compliance risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The module documentation claims the script generates a report from video performance data, but the output includes predetermined findings and recommendations unrelated to the actual spreadsheet contents. This creates a software integrity and trust issue: operators may rely on the report as an objective analysis when it is partly static and potentially misleading.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The report presents hard-coded conclusions, coaching guidance, and example judgments as if they were part of a data-driven analysis, which can mislead users into making business decisions based on unsupported claims. In this skill context, that is more dangerous because users expect creator-performance recommendations to be derived from the uploaded dataset, not fixed editorial content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This code writes a new PDF file to disk using data loaded from the provided spreadsheet. Although it prints the saved path afterward, there is no prior warning, confirmation, or explanatory comment/docstring specifically disclosing that input data will be exported into a persistent report file, which can matter when the report contains performance and creator-level data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.