AI Video Repurpose × Digital Human Dubbing

• Outcome: Review
• Latest audit: Jul 29, 2026 · 8:44 AM UTC
• Version: 1.0.2

Overview

This is a coherent media-repurposing web app, but it needs Review because it handles sensitive videos, cookies, external services, and persistent outputs with weak scoping and inconsistent disclosure.

Install only in a local or access-controlled environment. Do not expose the default 0.0.0.0 server to the internet without authentication, rate limits, and output access controls. Avoid putting real browser cookies in cookies.txt unless you understand that they are account session credentials, and do not process private videos, personal likenesses, or third-party content unless you have permission. Review retention and manually clean data/output and data/rewrites because generated files may persist.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (40)

Tainted flow: 'no_wm_url' from requests.get (line 185, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

raw_url = play_urls[0].replace('\\u002F', '/').replace('\\/', '/').replace('\\', '')
        no_wm_url = raw_url.replace('/playwm/', '/play/').replace('playwm?', 'play?')

        video_resp = requests.get(no_wm_url, headers=mobile_headers, proxies=proxies, timeout=120)
        if video_resp.status_code not in (200, 206):
            # 回退到有水印版本
            video_resp = requests.get(raw_url, headers=mobile_headers, proxies=proxies, timeout=120)

• Confidence: 94% confidence
• Finding: The code extracts a URL from remote HTML and immediately fetches it with requests.get without validating scheme, host, or destination. If the upstream page or parser output is manipulated, the server can be induced to make arbitrary outbound requests, creating an SSRF primitive that can reach internal services or unexpected external targets.

Tainted flow: 'raw_url' from requests.get (line 184, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

video_resp = requests.get(no_wm_url, headers=mobile_headers, proxies=proxies, timeout=120)
        if video_resp.status_code not in (200, 206):
            # 回退到有水印版本
            video_resp = requests.get(raw_url, headers=mobile_headers, proxies=proxies, timeout=120)

        if video_resp.status_code not in (200, 206):
            raise RuntimeError(f"视频下载失败（HTTP {video_resp.status_code}）")

• Confidence: 94% confidence
• Finding: The fallback request uses raw_url derived from untrusted network content and performs another server-side fetch with no destination validation. This doubles the SSRF surface and allows an attacker-controlled or altered page response to steer the backend to attacker-chosen URLs and download arbitrary content.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill describes capabilities including network access, shell execution, and file read/write, but it does not declare permissions or clearly constrain them. In a hosted agent environment, this weakens reviewability and can let a seemingly simple media tool perform broader actions than users or platform operators expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The public description frames the skill as a narrow Douyin/TikTok link repurposing tool, but the documented behavior is broader: direct media uploads, downloadable output hosting, and support for additional sources. This mismatch can mislead users and reviewers about the true attack surface, especially around data ingestion and file exposure.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs operators to provide browser-exported Douyin cookies, which are sensitive authentication material that can grant account access or session impersonation if mishandled. The prompt to hand cookies to an assistant is especially risky in this skill context because it normalizes credential transfer outside normal authentication flows.

Intent-Code Divergence

Low

• Confidence: 96% confidence
• Finding: The long-text Edge TTS branch references task_id inside _synthesize_edge even though task_id is not defined in that function's scope. An attacker or normal user can trigger this code path with sufficiently long input, causing a runtime failure and denial of service for TTS generation instead of producing the promised output.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The privacy document presents the system as 'all data default processed on your own machine, not uploaded to any third-party service' while the same section states that edge-tts sends audio data to Microsoft servers. This contradictory disclosure can mislead users into processing sensitive audio under a false assumption of full locality, creating privacy, consent, and compliance risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly promotes downloading third-party TikTok/Douyin videos and transforming them into a digital-human dubbed output, but it provides no guidance on copyright, consent, likeness rights, or privacy. In this context, the omission materially increases the likelihood of misuse for unauthorized redistribution, impersonation, or non-consensual synthetic media generation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documents persistent storage of downloads, transcripts, audio, and outputs, and also exposes download endpoints, but it does not present a clear user-facing warning at the point of use. This creates privacy and data exposure risk because users may submit sensitive media or links without understanding retention and retrieval implications.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Using browser-exported cookies for authenticated downloads without explicit warning or safeguards exposes highly sensitive credentials and can lead to account compromise, unauthorized access, and secondary abuse if the file is stored, logged, or shared. In this skill, the instruction to supply cookies materially increases danger because the workflow targets restricted content acquisition.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code sends user-provided transcript text and optional style instructions to an external OpenAI-compatible API, which is a real data exposure/privacy issue if users are not clearly informed or have not consented. In this product context, uploaded or extracted video scripts may contain personal, sensitive, or proprietary content, and the use of a configurable base_url increases the risk that data could be routed to a non-OpenAI third-party endpoint.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The rewritten content is persistently written to disk under a task-derived filename without any visible disclosure in this code path, creating a privacy and data retention concern. Because the content originates from user-supplied or scraped video text, stored files may contain personal data or copyrighted/proprietary material that remains on the server longer than users expect.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The UI explicitly asks users to upload a reference video of themselves for digital-human generation, which is highly sensitive biometric/identity-adjacent data. There is no visible notice explaining storage, retention, sharing, or processing of that video, so users may unknowingly submit personal media without informed consent or understanding of privacy risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The FAQ promotes a workflow that extracts speech from third-party short-video links, rewrites it, and generates synthetic voice/video output, but it does not warn about consent, privacy, impersonation, or data retention risks. In this skill's context, that omission is more dangerous because the tool is explicitly designed to make generated content look and sound like a real person, which can facilitate non-consensual cloning, deceptive media, or misuse of third-party content.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The documentation tells users to place an API key in a .env file but does not mention secret handling precautions such as excluding .env from version control, limiting file permissions, or avoiding exposure through logs and shared deployments. This is a real but lower-severity issue because it is documentation-level guidance rather than direct key exfiltration logic.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 核心框架
fastapi>=0.104.0
uvicorn[standard]>=0.24.0
python-multipart>=0.0.6
pydantic-settings>=2.1.0

• Confidence: 95% confidence
• Finding: Using a lower-bound specifier such as fastapi>=0.104.0 allows future builds to resolve to different versions, including newly introduced vulnerable or incompatible releases. In a web-facing backend, this weakens supply-chain control and makes security posture non-reproducible across environments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 核心框架
fastapi>=0.104.0
uvicorn[standard]>=0.24.0
python-multipart>=0.0.6
pydantic-settings>=2.1.0

# 视频下载

• Confidence: 95% confidence
• Finding: python-multipart>=0.0.6 permits uncontrolled upgrades and non-reproducible installs for a component that parses untrusted multipart input. Because this backend likely accepts uploads, dependency drift in this parser increases exposure to future parsing flaws and denial-of-service issues.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fastapi>=0.104.0
uvicorn[standard]>=0.24.0
python-multipart>=0.0.6
pydantic-settings>=2.1.0

# 视频下载
yt-dlp>=2023.10.0

• Confidence: 90% confidence
• Finding: pydantic-settings>=2.1.0 is not strictly exploitable by itself here, but unpinned dependencies create supply-chain uncertainty and make builds non-reproducible. This can lead to accidental adoption of insecure versions or breaking changes affecting configuration handling.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pydantic-settings>=2.1.0

# 视频下载
yt-dlp>=2023.10.0

# 语音转写
openai-whisper>=20231117

• Confidence: 97% confidence
• Finding: yt-dlp>=2023.10.0 is particularly risky as this application explicitly processes user-supplied Douyin/TikTok links, placing a network-facing content extraction tool directly on an untrusted input path. Leaving it unpinned increases the chance of silently pulling a vulnerable release or behavior-changing extractor code into production.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

yt-dlp>=2023.10.0

# 语音转写
openai-whisper>=20231117

# AI 改写
openai>=1.6.0

• Confidence: 90% confidence
• Finding: openai-whisper>=20231117 introduces supply-chain unpredictability for a package that processes untrusted media files. Because the application ingests arbitrary external videos, deterministic dependency control is important to avoid unexpected vulnerable parsing/transcoding behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai-whisper>=20231117

# AI 改写
openai>=1.6.0

# 音频处理
edge-tts>=6.1.0

• Confidence: 88% confidence
• Finding: openai>=1.6.0 being unpinned mainly creates reproducibility and supply-chain management risk rather than a direct application vulnerability from this file alone. API client behavior can change across releases, affecting security controls, error handling, and secret usage.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.6.0

# 音频处理
edge-tts>=6.1.0
pydub>=0.25.1
soundfile>=0.12.1

• Confidence: 88% confidence
• Finding: edge-tts>=6.1.0 allows uncontrolled upgrades of a networked text-to-speech dependency. This is primarily a supply-chain hygiene issue, but still matters because the service is part of an automated media-processing pipeline exposed to user content.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 音频处理
edge-tts>=6.1.0
pydub>=0.25.1
soundfile>=0.12.1

# 数字人 - SadTalker

• Confidence: 90% confidence
• Finding: pydub>=0.25.1 is used in audio processing and may invoke underlying media tooling on untrusted content. Unpinned versions make builds drift over time and can introduce newly vulnerable parsing or command-execution pathways in media pipelines.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 音频处理
edge-tts>=6.1.0
pydub>=0.25.1
soundfile>=0.12.1

# 数字人 - SadTalker
torch>=2.1.0

• Confidence: 90% confidence
• Finding: soundfile>=0.12.1 participates in parsing externally sourced media, so non-deterministic upgrades may expose the service to newly introduced parsing vulnerabilities or crashes. Given the skill's automated video/audio ingestion workflow, this is more concerning than a purely internal library.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

soundfile>=0.12.1

# 数字人 - SadTalker
torch>=2.1.0
torchvision>=0.16.0
gfpgan>=1.3.8
basicsr>=1.4.2

• Confidence: 96% confidence
• Finding: torch>=2.1.0 is a large, security-relevant ML framework with a history of deserialization and memory-safety issues. In a media-processing backend that may load models and process attacker-influenced inputs, leaving PyTorch unpinned increases exposure to vulnerable or incompatible versions.

Static analysis

No suspicious patterns detected.