AI Video Repurpose × Digital Human Dubbing

• Outcome: Review
• Latest audit: Jul 29, 2026 · 8:44 AM UTC
• Version: 1.0.2

Overview

This is a coherent media-repurposing web app, but it needs Review because it handles sensitive videos, cookies, external services, and persistent outputs with weak scoping and inconsistent disclosure.

Install only in a local or access-controlled environment. Do not expose the default 0.0.0.0 server to the internet without authentication, rate limits, and output access controls. Avoid putting real browser cookies in cookies.txt unless you understand that they are account session credentials, and do not process private videos, personal likenesses, or third-party content unless you have permission. Review retention and manually clean data/output and data/rewrites because generated files may persist.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (40)

Tainted flow: 'no_wm_url' from requests.get (line 185, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

raw_url = play_urls[0].replace('\\u002F', '/').replace('\\/', '/').replace('\\', '')
        no_wm_url = raw_url.replace('/playwm/', '/play/').replace('playwm?', 'play?')

        video_resp = requests.get(no_wm_url, headers=mobile_headers, proxies=proxies, timeout=120)
        if video_resp.status_code not in (200, 206):
            # 回退到有水印版本
            video_resp = requests.get(raw_url, headers=mobile_headers, proxies=proxies, timeout=120)

• Confidence: 94% confidence
• Finding: video_resp = requests.get(no_wm_url, headers=mobile_headers, proxies=proxies, timeout=120)

Tainted flow: 'raw_url' from requests.get (line 184, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

video_resp = requests.get(no_wm_url, headers=mobile_headers, proxies=proxies, timeout=120)
        if video_resp.status_code not in (200, 206):
            # 回退到有水印版本
            video_resp = requests.get(raw_url, headers=mobile_headers, proxies=proxies, timeout=120)

        if video_resp.status_code not in (200, 206):
            raise RuntimeError(f"视频下载失败（HTTP {video_resp.status_code}）")

• Confidence: 94% confidence
• Finding: video_resp = requests.get(raw_url, headers=mobile_headers, proxies=proxies, timeout=120)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill describes capabilities including network access, shell execution, and file read/write, but it does not declare permissions or clearly constrain them. In a hosted agent environment, this weakens reviewability and can let a seemingly simple media tool perform broader actions than users or platform operators expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The public description frames the skill as a narrow Douyin/TikTok link repurposing tool, but the documented behavior is broader: direct media uploads, downloadable output hosting, and support for additional sources. This mismatch can mislead users and reviewers about the true attack surface, especially around data ingestion and file exposure.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs operators to provide browser-exported Douyin cookies, which are sensitive authentication material that can grant account access or session impersonation if mishandled. The prompt to hand cookies to an assistant is especially risky in this skill context because it normalizes credential transfer outside normal authentication flows.

Intent-Code Divergence

Low

• Confidence: 96% confidence
• Finding: The long-text Edge TTS branch references task_id inside _synthesize_edge even though task_id is not defined in that function's scope. An attacker or normal user can trigger this code path with sufficiently long input, causing a runtime failure and denial of service for TTS generation instead of producing the promised output.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The privacy document presents the system as 'all data default processed on your own machine, not uploaded to any third-party service' while the same section states that edge-tts sends audio data to Microsoft servers. This contradictory disclosure can mislead users into processing sensitive audio under a false assumption of full locality, creating privacy, consent, and compliance risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README explicitly promotes downloading third-party TikTok/Douyin videos and transforming them into a digital-human dubbed output, but it provides no guidance on copyright, consent, likeness rights, or privacy. In this context, the omission materially increases the likelihood of misuse for unauthorized redistribution, impersonation, or non-consensual synthetic media generation.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documents persistent storage of downloads, transcripts, audio, and outputs, and also exposes download endpoints, but it does not present a clear user-facing warning at the point of use. This creates privacy and data exposure risk because users may submit sensitive media or links without understanding retention and retrieval implications.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Using browser-exported cookies for authenticated downloads without explicit warning or safeguards exposes highly sensitive credentials and can lead to account compromise, unauthorized access, and secondary abuse if the file is stored, logged, or shared. In this skill, the instruction to supply cookies materially increases danger because the workflow targets restricted content acquisition.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code sends user-provided transcript text and optional style instructions to an external OpenAI-compatible API, which is a real data exposure/privacy issue if users are not clearly informed or have not consented. In this product context, uploaded or extracted video scripts may contain personal, sensitive, or proprietary content, and the use of a configurable base_url increases the risk that data could be routed to a non-OpenAI third-party endpoint.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The rewritten content is persistently written to disk under a task-derived filename without any visible disclosure in this code path, creating a privacy and data retention concern. Because the content originates from user-supplied or scraped video text, stored files may contain personal data or copyrighted/proprietary material that remains on the server longer than users expect.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The UI explicitly asks users to upload a reference video of themselves for digital-human generation, which is highly sensitive biometric/identity-adjacent data. There is no visible notice explaining storage, retention, sharing, or processing of that video, so users may unknowingly submit personal media without informed consent or understanding of privacy risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The FAQ promotes a workflow that extracts speech from third-party short-video links, rewrites it, and generates synthetic voice/video output, but it does not warn about consent, privacy, impersonation, or data retention risks. In this skill's context, that omission is more dangerous because the tool is explicitly designed to make generated content look and sound like a real person, which can facilitate non-consensual cloning, deceptive media, or misuse of third-party content.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The documentation tells users to place an API key in a .env file but does not mention secret handling precautions such as excluding .env from version control, limiting file permissions, or avoiding exposure through logs and shared deployments. This is a real but lower-severity issue because it is documentation-level guidance rather than direct key exfiltration logic.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 核心框架
fastapi>=0.104.0
uvicorn[standard]>=0.24.0
python-multipart>=0.0.6
pydantic-settings>=2.1.0

• Confidence: 95% confidence
• Finding: fastapi>=0.104.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 核心框架
fastapi>=0.104.0
uvicorn[standard]>=0.24.0
python-multipart>=0.0.6
pydantic-settings>=2.1.0

# 视频下载

• Confidence: 95% confidence
• Finding: python-multipart>=0.0.6

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fastapi>=0.104.0
uvicorn[standard]>=0.24.0
python-multipart>=0.0.6
pydantic-settings>=2.1.0

# 视频下载
yt-dlp>=2023.10.0

• Confidence: 90% confidence
• Finding: pydantic-settings>=2.1.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pydantic-settings>=2.1.0

# 视频下载
yt-dlp>=2023.10.0

# 语音转写
openai-whisper>=20231117

• Confidence: 97% confidence
• Finding: yt-dlp>=2023.10.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

yt-dlp>=2023.10.0

# 语音转写
openai-whisper>=20231117

# AI 改写
openai>=1.6.0

• Confidence: 90% confidence
• Finding: openai-whisper>=20231117

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai-whisper>=20231117

# AI 改写
openai>=1.6.0

# 音频处理
edge-tts>=6.1.0

• Confidence: 88% confidence
• Finding: openai>=1.6.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai>=1.6.0

# 音频处理
edge-tts>=6.1.0
pydub>=0.25.1
soundfile>=0.12.1

• Confidence: 88% confidence
• Finding: edge-tts>=6.1.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 音频处理
edge-tts>=6.1.0
pydub>=0.25.1
soundfile>=0.12.1

# 数字人 - SadTalker

• Confidence: 90% confidence
• Finding: pydub>=0.25.1

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 音频处理
edge-tts>=6.1.0
pydub>=0.25.1
soundfile>=0.12.1

# 数字人 - SadTalker
torch>=2.1.0

• Confidence: 90% confidence
• Finding: soundfile>=0.12.1

Unpinned Dependencies

Low

• Category: Supply Chain

Content

soundfile>=0.12.1

# 数字人 - SadTalker
torch>=2.1.0
torchvision>=0.16.0
gfpgan>=1.3.8
basicsr>=1.4.2

• Confidence: 96% confidence
• Finding: torch>=2.1.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.