Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 技能库在 `skills/` 目录：每个子目录一份 `SKILL.md`（YAML frontmatter：`name` + `description`）+ 可选 `references/`（细分规范）。
Security audit
AI-driven infinite creation in animation - one-click generation of videos from novels/scripts
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent local video-generation skill, but it asks an agent to install and run unpinned external project code, run long automated jobs, store project data, and generate installable skills with limited safety scoping.
Install only if you are comfortable running unpinned external project code and dependencies. Use a trusted LLM endpoint, avoid sensitive manuscripts or private voice/media unless you understand provider retention, review generated skills before enabling them, and set clear limits for runtime, disk usage, and GPU/CPU load.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 技能库在 `skills/` 目录：每个子目录一份 `SKILL.md`（YAML frontmatter：`name` + `description`）+ 可选 `references/`（细分规范）。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 技能库在 `skills/` 目录：每个子目录一份 `SKILL.md`（YAML frontmatter：`name` + `description`）+ 可选 `references/`（细分规范）。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - 技能库在 `skills/` 目录：每个子目录一份 `SKILL.md`（YAML frontmatter：`name` + `description`）+ 可选 `references/`（细分规范）。
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README encourages fully automated ingestion of novels, scripts, assets, workflow JSON, and API-based model/service configuration, but it does not clearly warn users about privacy, retention, or data-sharing risks. In a system designed for unattended long-running agent execution and third-party model/API integration, users may unknowingly expose copyrighted manuscripts, voice samples, personal media, or API keys to external services or generated skills/workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README emphasizes unattended, fully automated generation and describes persistent project isolation and asset storage, but it does not clearly warn users that large amounts of source text, generated media, and metadata will be written to local storage and retained across runs. In a content-generation agent that processes novels, scripts, voices, and assets, this omission can lead to unintentional retention of sensitive or copyrighted material, especially when users assume the workflow is ephemeral.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README instructs users to configure an OpenAI-compatible Base URL, model, and API key for the agent brain, but does not clearly warn that uploaded novels, scripts, prompts, and possibly derived context may be transmitted to third-party LLM providers. Given this skill's purpose—processing long-form creative text and project context—users may unknowingly expose sensitive, proprietary, or copyrighted material to external services.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The skill advertises fully automatic end-to-end generation and execution across LLM, image, TTS, video, and ffmpeg stages, but does not require user-facing warnings or consent around GPU/CPU load, long runtimes, disk usage, or output generation. In a local agent context, this increases the risk of unexpected system-side effects and denial-of-service-like resource exhaustion, especially because the workflow is designed for batch and potentially unlimited-length output.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md | `tts` 音色设计 | 人物音色样本 | ComfyUI TTS | 每个角色的 voice_ref | | `video` 分镜视频 | 逐镜出带语音视频 + 合并 | ComfyUI r2v + ffmpeg | 分镜视频、成片 | 分步约定（与 `skills/novel-to-video/SKILL.md` 一致）： 1. **剧本/大纲**：输入小说或想法 → 产出 title/logline/characters/scenes/props/storyboard 大纲 JSON。 2. **一致性锚点**：`bible.md`（每个角色唯一外貌/配色/声音 + 衣橱）+ `style.md`（统一画风/光线/色调/镜头语言）。
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The rule '未命中时默认走 novel-to-video（总流水线）' creates an unsafe fallback that can launch the most powerful, side-effectful pipeline when intent is ambiguous or parsing fails. In this skill, that pipeline can trigger multi-stage content generation, external ComfyUI jobs, ffmpeg processing, and file creation, so an unrelated or underspecified request may still cause substantial local execution and resource consumption.
- Content
Static analysis
No suspicious patterns detected.