Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed media-processing integration that uploads user-selected images or videos to 550W and uses scoped credentials with explicit consent gates.
Install only if you are comfortable sending selected media, share links, and necessary 550W account credentials to the 550W service. Prefer OAuth or environment/host-managed credentials on shared systems, review credit charges before processing, and confirm deletion only for the exact task you intend to remove.
The skill can read user-selected local media and upload it to a remote endpoint, but the high-level description does not make that data-transfer behavior sufficiently prominent. In a privacy-sensitive context, under-disclosed remote upload of local files can lead to unintended exfiltration of personal or proprietary media.
The skill can read user-selected local media and upload it to a remote endpoint, but the high-level description does not make that data-transfer behavior sufficiently prominent. In a privacy-sensitive context, under-disclosed remote upload of local files can lead to unintended exfiltration of personal or proprietary media.
The skill can read user-selected local media and upload it to a remote endpoint, but the high-level description does not make that data-transfer behavior sufficiently prominent. In a privacy-sensitive context, under-disclosed remote upload of local files can lead to unintended exfiltration of personal or proprietary media.
The skill can read user-selected local media and upload it to a remote endpoint, but the high-level description does not make that data-transfer behavior sufficiently prominent. In a privacy-sensitive context, under-disclosed remote upload of local files can lead to unintended exfiltration of personal or proprietary media.
The skill can read user-selected local media and upload it to a remote endpoint, but the high-level description does not make that data-transfer behavior sufficiently prominent. In a privacy-sensitive context, under-disclosed remote upload of local files can lead to unintended exfiltration of personal or proprietary media.
The skill can read user-selected local media and upload it to a remote endpoint, but the high-level description does not make that data-transfer behavior sufficiently prominent. In a privacy-sensitive context, under-disclosed remote upload of local files can lead to unintended exfiltration of personal or proprietary media.
The skill can read user-selected local media and upload it to a remote endpoint, but the high-level description does not make that data-transfer behavior sufficiently prominent. In a privacy-sensitive context, under-disclosed remote upload of local files can lead to unintended exfiltration of personal or proprietary media.
The skill can read user-selected local media and upload it to a remote endpoint, but the high-level description does not make that data-transfer behavior sufficiently prominent. In a privacy-sensitive context, under-disclosed remote upload of local files can lead to unintended exfiltration of personal or proprietary media.
The skill can read user-selected local media and upload it to a remote endpoint, but the high-level description does not make that data-transfer behavior sufficiently prominent. In a privacy-sensitive context, under-disclosed remote upload of local files can lead to unintended exfiltration of personal or proprietary media.
The skill can read user-selected local media and upload it to a remote endpoint, but the high-level description does not make that data-transfer behavior sufficiently prominent. In a privacy-sensitive context, under-disclosed remote upload of local files can lead to unintended exfiltration of personal or proprietary media.
Referenced artifact was not completely inspected
file transfer. API Key uses an absolute `params.filePath`; OAuth uses bundled `scripts/550w-upload.cjs` inspect/upload and remote upload tickets. Read the sele
The skill can source API credentials from local files such as 550w-ai/credentials.json and a legacy .credentials.json fallback, then optionally persist credentials after verification. Local credential-file access materially increases secret exposure risk on shared hosts, through weak file permissions, accidental inclusion in backups/logs, or unauthorized reuse by other processes.
This Skill grants no permissions. Use host-approved remote MCP tools, or bundled Node.js entrypoints only when execution is allowed. Read only explicitly selected images/videos; do not enumerate directories, read SSH/cloud/browser credentials, or change host rules, memory or startup files. Use only media, credits and task tools listed in the selected workflow. Task deletion requires separate user approval.
The API Key entrypoint uses only SUBTITLE_REMOVER_USER_NO and SUBTITLE_REMOVER_API_KEY, or its own user configuration file 550w-ai/credentials.json; the legacy installation .credentials.json is a read-only fallback. Region/language, configuration-directory variables and FFPROBE_PATH are local configuration, not an environment dump sent over the network. Before configureCredentials verifies and saves credentials, obtain explicit consent and set confirmCredentialStorage=true. Prefer OAuth or environment credentials on shared hosts; never print secrets in conversation or logs.
API Key video workflows may invoke ffprobe through execFile to inspect selected local videos or URLs passing public-address validation; user input is not executed through a shell. Host permission to run that binary is required. If probing is unavailable, explain the limitation rather than inventing dimensions/duration. Credit/task queries and separately confirmed task deletion support media processing; never purchase credits for the user. Installing the global package selects overseas service and English by default; use the domestic package for domestic service. Language changes must not silently switch account or service region.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
get error() {
if (this._error)
return this._error;
const error = new ZodError_js_1.ZodError(ctx.common.issues);
this._error = error;
return this._error;
}
};
}
};
function processCreateParams(params) {
if (!params)
return {};
const { errorMap, invalid_type_error, required_error, description: description2 } = params;
if (errorMap && (invalid_type_error || required_error)) {
throw new Error(`Can't use "invalid_type_error" or "required_error" in conjunction with custom error map.`);
}
if (errorMap)
return { errorMap, description: description2 };
const customMap = (iss, ctx) => {
const { message } = params;
if (iss.code === "invalid_enum_value") {
return { message: message ?? ctx.defaultError };
}
if (typeof ctx.data === "undefined") {
return { message: message ?? required_error ??
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
...util.normalizeParams(params)
});
}
// @__NO_SIDE_EFFECTS__
function keyof(schema) {
const shape = schema._zod.def.shape;
return /* @__PURE__ */ _enum(Object.keys(shape));
}
exports2.ZodMiniObject = core.$constructor("ZodMiniObject", (inst, def) => {
core.$ZodObject.init(inst, def);
exports2.ZodMiniType.init(inst, def);
util.installLazyProp(inst, "shape", (self) => self._zod.def.shape, false);
});
// @__NO_SIDE_EFFECTS__
function object(shape, params) {
const def = {
type: "object",
shape: shape ?? {},
...util.normalizeParams(params)
};
return new exports2.ZodMiniObject(def);
}
// @__NO_SIDE_EFFECTS__
function strictObject(shape, params) {
return new exports2.ZodMiniObject({
type: "object",
shape,
catchall: /* @__PURE__ */ never(),
...util.normalizeParams(params)
});
}
// @__NO_SIDE_EFFECTS__
function loos
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
function validateAsync() {
const ruleErrs = gen.let("ruleErrs", null);
gen.try(() => assignValid((0, codegen_1._)`await `), (e) => gen.assign(valid, false).if((0, codegen_1._)`${e} instanceof ${it.ValidationError}`, () => gen.assign(ruleErrs, (0, codegen_1._)`${e}.errors`), () => gen.throw(e)));
return ruleErrs;
}
function validateSync() {
const validateErrs = (0, codegen_1._)`${validateRef}.errors`;
The skill reads and writes credentials in predictable filesystem locations such as ~/.config/550w-ai/credentials.json. Secrets stored in plaintext on disk are high-value targets and may be recoverable by other local processes, backups, logs, or users on shared systems.
var CredentialManager = class {
constructor(storagePath) {
const configRoot = process.env.XDG_CONFIG_HOME?.trim() || (process.platform === "win32" ? process.env.APPDATA?.trim() : null) || path.join(os.homedir(), ".config");
this.storagePath = storagePath ?? path.join(configRoot, "550w-ai", "credentials.json");
this.legacyStoragePath = path.resolve(__dirname, "../.credentials.json");
}
get() {
The legacy fallback path ../.credentials.json broadens the search space for secret discovery and may cause the skill to pick up unintended credentials from project directories. Predictable fallback secret files are risky because they are easy to leak via source control, workspace sharing, or unrelated tooling.
constructor(storagePath) {
const configRoot = process.env.XDG_CONFIG_HOME?.trim() || (process.platform === "win32" ? process.env.APPDATA?.trim() : null) || path.join(os.homedir(), ".config");
this.storagePath = storagePath ?? path.join(configRoot, "550w-ai", "credentials.json");
this.legacyStoragePath = path.resolve(__dirname, "../.credentials.json");
}
get() {
const envUserNo = process.env.SUBTITLE_REMOVER_USER_NO?.trim();
This file implements a destructive remote task-deletion action even though the skill is presented as a subtitle/watermark remover. The mismatch expands the skill's authority beyond user expectations, increasing the risk of unauthorized or deceptive data-destruction workflows; the confirmDeletion flag reduces accidental invocation but does not address the hidden capability itself.
The implemented behavior returns success for deleting a remote task and asynchronously cleaning up related media, but the skill metadata only advertises watermark/text/subtitle removal. Omitting destructive deletion behavior from the manifest undermines informed consent and enables users or hosts to invoke a high-risk action without clear awareness of the consequence.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const configRoot = process.env.XDG_CONFIG_HOME?.trim()
|| (process.platform === "win32" ? process.env.APPDATA?.trim() : null)
|| path.join(os.homedir(), ".config");
this.storagePath = storagePath ?? path.join(configRoot, "550w-ai", "credentials.json");
this.legacyStoragePath = path.resolve(__dirname, "../.credentials.json");
}
get() {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const configRoot = process.env.XDG_CONFIG_HOME?.trim()
|| (process.platform === "win32" ? process.env.APPDATA?.trim() : null)
|| path.join(os.homedir(), ".config");
this.storagePath = storagePath ?? path.join(configRoot, "550w-ai", "credentials.json");
this.legacyStoragePath = path.resolve(__dirname, "../.credentials.json");
}
get() {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const configRoot = process.env.XDG_CONFIG_HOME?.trim()
|| (process.platform === "win32" ? process.env.APPDATA?.trim() : null)
|| path.join(os.homedir(), ".config");
this.storagePath = storagePath ?? path.join(configRoot, "550w-ai", "credentials.json");
this.legacyStoragePath = path.resolve(__dirname, "../.credentials.json");
}
get() {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
const configRoot = process.env.XDG_CONFIG_HOME?.trim()
|| (process.platform === "win32" ? process.env.APPDATA?.trim() : null)
|| path.join(os.homedir(), ".config");
this.storagePath = storagePath ?? path.join(configRoot, "550w-ai", "credentials.json");
this.legacyStoragePath = path.resolve(__dirname, "../.credentials.json");
}
get() {
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
if (!(key in state.jobs)) {
return;
}
delete state.jobs[key];
if (error) {
abort(state);
} else {
The skill explicitly describes network access, environment-variable credential use, and local Node.js/ffprobe execution, yet it declares no explicit tool scope or allowed-tools boundary. That creates a permission-model mismatch where a host or reviewer may underestimate the skill's ability to access secrets, exfiltrate media, or invoke local binaries.
Detected: suspicious.dynamic_code_execution, suspicious.env_credential_access