Security audit

vid2llm

Security checks for vulnerabilities and agentic risk

Overview

The skill is transparent about using a paid video-transcription service, but it gives an unpinned npm command access to a funded wallet private key and may spend small amounts automatically.

Install only if you are comfortable sending public video URLs to vid2llm and paying per video from a dedicated, low-balance Base USDC wallet. Prefer a pinned or otherwise vetted package version, keep `VID2LLM_MAX_PRICE` low, and require approval before any paid watch action.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The trigger condition is broad enough that the skill may activate for many ordinary requests containing a public video link, causing the agent to invoke a paid external tool by default. In this specific skill, overbroad triggering is more dangerous because each watch call can spend funds from a wallet and send user-supplied URLs to a third-party service, creating unnecessary cost and privacy exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill instructs the agent to execute npx -y vid2llm-mcp without pinning a package version, which causes code to be fetched and run from the npm registry at execution time. If the package is updated maliciously, compromised, or a dependency is hijacked, an agent following this skill could execute attacker-controlled code and expose sensitive environment variables such as VID2LLM_PRIVATE_KEY.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: This command again uses an unpinned npx package fetch for the paid watch path, meaning arbitrary updated registry code may run at the moment the skill is invoked. Because this path requires a funded wallet private key in the environment, compromise of the package or its dependencies could directly lead to key theft and unauthorized spending.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The --visuals variant still executes an unpinned npm package via npx, preserving the same supply-chain execution risk. In this skill, the danger is elevated by the presence of a payment key in environment variables and by the fact that agents may automatically run the command on user-provided links.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: Referencing the MCP server as npx -y vid2llm-mcp with no pinned version means the server implementation can change unexpectedly or be replaced through supply-chain compromise. Even when used as a server rather than a one-shot CLI, the agent may still end up launching untrusted code with its available permissions and secrets.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.