特看视频 AI 创作工具

• Outcome: Review
• Latest audit: May 28, 2026 · 2:10 PM UTC
• Version: 1.0.0

Overview

This appears to be a real Tekan media-generation skill, but it needs review because it stores account credentials and can automatically upload personal media or spend credits with weak confirmation.

Install only if you trust the publisher and Tekan/Topview with your files and account. Before use, explicitly confirm uploads, paid generation jobs, voice cloning, watermark removal, webhook URLs, and any deletion. Avoid submitting third-party faces or voices without consent, do not use it with confidential product assets unless remote processing is acceptable, and run logout or remove ~/.tekan/credentials.json on shared machines.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (30)

Tainted flow: 'url' from os.environ.get (line 113, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

f"Submitting remove-background (Tekan {TEKAN_COMMON_TASK_URL})...",
            file=sys.stderr,
        )
    resp = requests.post(
        url,
        headers=_tekan_uid_headers(client),
        json=body,

• Confidence: 94% confidence
• Finding: The request destination is derived from the environment variable `TEKAN_COMMON_TASK_URL` without validation, then used in `requests.post` while sending authenticated headers (`uid`, `teamId`) and task data. If an attacker can influence the process environment, they can redirect requests to an arbitrary host, causing SSRF-style outbound access and exfiltration of request metadata or uploaded-workflow data.

Tainted flow: 'url' from os.environ.get (line 113, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

raise TimeoutError(
                f"Task {task_id} did not complete within {timeout}s"
            )
        resp = requests.get(
            url,
            headers=_tekan_uid_headers(client),
            params={"taskId": task_id},

• Confidence: 94% confidence
• Finding: The polling `GET` request uses a base URL ultimately sourced from `TEKAN_COMMON_TASK_URL` without sanitization, allowing an attacker-controlled environment value to redirect repeated requests to arbitrary internal or external endpoints. Because the code continuously polls and includes identifying headers, exploitation could enable SSRF, internal network probing, and leakage of task identifiers or service metadata.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The README tells the agent to use this skill for a very broad set of user mentions and creative tasks without clear boundaries, exclusions, or disambiguation rules. That can cause over-triggering, where the agent invokes the skill on ambiguous requests and may send user content or media to external generation services unexpectedly.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The statement that users can freely describe any creative vision and the AI will find a way to implement it reinforces an effectively unbounded activation condition. In an agent setting, this increases the chance the skill is selected for loosely related prompts and performs external, potentially costly or privacy-impacting actions without sufficiently explicit user intent.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The README promotes voice cloning and states that login credentials are automatically stored locally, but it does not warn users about the sensitivity of biometric voice data or the security/privacy implications of stored authentication tokens. This creates risk of unauthorized impersonation, misuse of personal data, and credential exposure on shared or compromised machines.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The module list includes account-linked operations such as voice deletion, board management, usage history, and balance access, but the README does not warn about irreversible actions or account-impacting effects. In an autonomous agent context, users may not realize that a natural-language request could delete assets, alter account state, or expose account information.

Vague Triggers

High

• Confidence: 92% confidence
• Finding: The trigger conditions are extremely broad, including generic references to creative workflows even when the user does not explicitly name the tool. This creates a real risk of over-triggering, causing unintended execution of a high-capability skill that can authenticate, upload files, and call external services.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation describes submitting prompts and local reference images to the AI image tool but does not warn that these inputs may be sent to an external third-party service for processing. This can cause users to unknowingly transmit sensitive text, proprietary images, personal data, or regulated content outside their environment, creating privacy, compliance, and data-handling risks.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The document instructs the agent to persist OAuth-derived credentials locally and later display account identifiers and a masked API key in status output, but it does not require explicit user consent or a privacy notice before doing so. In an agent setting, silent local persistence of auth material and exposure of personal account metadata can violate user expectations and increase the risk of credential or privacy leakage on shared machines.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation exposes a destructive `delete` operation for boards but provides no guidance on confirmation, reversibility, or safeguards. In an agent-driven workflow, this increases the chance of accidental or unauthorized deletion of user content, especially if the agent follows terse commands or misinterprets intent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The `detail` command is documented as returning sensitive metadata including members and share tokens, but there is no warning about treating these values as secrets or limiting disclosure. Share tokens can enable unintended access, and surfacing them to an agent or user interface without precautions can leak privileged collaboration links.

Vague Triggers

High

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to treat broad, ordinary language like generic ecommerce-image requests as automatic invocation triggers and to skip clarifying questions. Combined with the "用户发了图就直接执行 run" guidance, this creates ambiguous activation that can cause unintended backend actions and image uploads from routine conversation rather than clear, informed user consent.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: Treating generic affirmative replies such as "好的", "可以", or "继续" as immediate execution triggers is dangerous because those phrases commonly appear in normal dialogue without meaning 'upload my images and start a remote job now.' In this skill context, the consequence is especially risky because execution sends user-provided media to external processing pipelines and may apply transformations automatically.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document describes image-based workflows that upload local paths or URLs into backend/API services, but it does not clearly warn users that their images will be transmitted off-device for processing. This undermines informed consent and can expose sensitive commercial assets, faces, branding, or metadata to remote services without the user's clear awareness.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill encourages immediate execution while defaulting to automatic background removal and other preprocessing, but it does not warn users that their images may be altered before generation. In an ecommerce workflow, silent preprocessing can materially affect product appearance, compliance, branding accuracy, or evidence value, making the lack of notice more dangerous than in a purely decorative context.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly supports passing local file paths for product, face, and template images and writing outputs to a local path, but it gives no warning that these files may be uploaded to a remote service or overwritten locally. In an agent setting, this can cause unintended disclosure of sensitive images/biometrics and unexpected local file modification if users or upstream prompts provide unsafe paths.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation exposes a `--notice-url` webhook option without warning that task completion data will be sent to an external endpoint controlled by the caller. In an agentic context, this can enable unintended data egress, SSRF-like interactions, or exfiltration of file/task metadata if an agent passes untrusted URLs or uses internal-only endpoints.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly says local image/video paths supplied in JSON fields will be automatically uploaded, but it does not warn users that local files may be transmitted off-device to an external service. In a media-generation skill, users may reasonably pass sensitive personal photos, internal product assets, or private videos; silent upload behavior increases the risk of unintended data disclosure.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The `--internet-search` option enables external network access, but the documentation does not disclose that enabling it may send prompts or related request context to outside services. This can expose user intent or sensitive prompt content beyond the primary platform, especially if users assume the workflow is self-contained.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: 该文档明确支持声音克隆与删除等高影响操作，却没有要求获得被克隆者同意、验证授权来源，或在删除前提醒不可逆后果。对于支持声音克隆的技能，这会降低操作者对隐私、冒用和误删风险的警觉，增加未经授权克隆他人声音或误删自定义资产的可能性。

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script accepts local paths via --input-images and transparently uploads them to a remote service by resolving them into file IDs, but the CLI help and execution path do not clearly warn users at the point of use that local files will leave the machine. In an agent setting, this can cause unintended exfiltration of sensitive local images if the user or calling workflow provides a path assuming only local processing.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script treats local file paths as uploadable inputs and transparently sends product, template, or face images to a remote API, but provides no explicit consent prompt, warning, or privacy notice at the point of use. In an agent setting, this is risky because users may believe a local-path argument is processed locally, while sensitive images or biometric face data are actually exfiltrated to a third-party service.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script accepts a user-supplied webhook URL and forwards it to the remote API without validation or warning, enabling task-result notifications to arbitrary third-party endpoints. In an agent workflow, this can leak task metadata or result availability to attacker-controlled infrastructure and may facilitate unintended outbound communication channels.

Ssd 4

Medium

• Confidence: 91% confidence
• Finding: The embedded agent instructions explicitly push autonomous execution, suppress user choice, and instruct the agent not to ask for confirmation before running tasks. In an agent setting that can spend credits, upload user-provided images, or trigger external API actions, this increases the chance of unintended operations and weakens human-in-the-loop safeguards.

Credential Access

High

• Category: Privilege Escalation

Content

1. 调用远程 OAuth 服务器启动设备会话
2. 输出授权链接（`URL: https://...`），并尝试自动打开浏览器（无浏览器环境下静默跳过）
3. 自动轮询直到用户授权（或会话过期）
4. 成功后将凭证保存到 `~/.tekan/credentials.json`

**关键：无论浏览器是否成功打开，Agent 都必须从命令输出中提取授权链接，并在引导消息中以 `[👉 点击此处完成登录授权](实际URL)` 的 Markdown 链接格式提供给用户**；详见主 SKILL 中「安装完成与登录引导」步骤 2 的详细规则和正反示例。

• Confidence: 91% confidence
• Finding: This section explicitly directs the agent to complete an OAuth device flow and save the resulting credentials to ~/.tekan/credentials.json. Credential acquisition and local persistence are security-sensitive operations; if mishandled by the agent, logs, or a multi-user environment, they can expose long-lived authentication material and enable account takeover or unauthorized API use.

Static analysis

No suspicious patterns detected.