Tencent MPS Video Dubbing

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 1.0.6

Overview

This video dubbing skill appears purpose-aligned, but it automatically changes the Python environment and broadly loads local credential/config files while handling paid Tencent Cloud access.

Install only if you are comfortable giving it Tencent Cloud credentials and letting it upload/download video files through COS. Use least-privilege, preferably temporary Tencent credentials; avoid putting secrets in command arguments; do not run it from untrusted directories; and consider disabling the auto-upgrade behavior or installing pinned dependencies in a separate virtual environment first.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: scripts/mps_auto_upgrade.py:106
• Finding: Automatic Installation and Upgrade of Unpinned Runtime Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mps_auto_upgrade.py:106-119, 131-154`; `scripts/requirements.txt:21-23` **Vulnerability Type**: Runtime supply-chain exposure through mutable dependencies **Risk Level**: High ### Vulnerable Code ```python def _pip_install(specs): """Execute python3 -m pip install to install or upgrade dependencies.""" cmd = [sys.executable, "-m", "pip", "install", "--upgrade", "--quiet"] + specs print(f"Installing or upgrading dependencies: {', '.join(specs)}", file=sys.stderr) result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print( f"Automatic installation failed. Run manually:\n" f" python3 -m pip install --upgrade {' '.join(repr(s) for s in specs)}\n" f" Error: {result.stderr.strip()}", file=sys.stderr, ) sys.exit(1) ``` ```python def check_sdk_version(): to_install = [] for pkg_name, min_ver in _DEPENDENCIES: min_ver_str = ".".join(map(str, min_ver)) if min_ver else None spec = f"{pkg_name}>={min_ver_str}" if min_ver_str else pkg_name try: installed_ver = _pkg_version(pkg_name) except PackageNotFoundError: to_install.append(spec) continue if min_ver and _ver_tuple(installed_ver) < min_ver: to_install.append(spec) if to_install: _pip_install(to_install) ``` ```text tencentcloud-sdk-python>=3.1.139 cos-python-sdk-v5>=1.9.30 python-dotenv>=1.0.0 ``` ### Technical Analysis Normal Skill execution calls `check_sdk_version()` before importing the Tencent Cloud, COS, and dotenv libraries. If a package is missing or below the minimum version, the process automatically invokes pip and installs the newest version satisfying an open-ended lower-bound constraint. The dependencies are not pinned to reviewed versions and are not protected with package hashes. Consequently, the ...[truncated 1791 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove dependency installation and upgrades from normal runtime execution. 2. Require dependencies to be installed during an explicit, user-approved setup or deployment stage. 3. Pin every direct and transitive dependency to an exact reviewed version. 4. Generate a lock file containing cryptographic hashes and install with pip's `--require-hashes` option. 5. Use a dedicated virtual environment or immutable container image rather than modifying the Agent's active Python environment. 6. Restrict installation to an explicitly configured trusted package index. 7. Perform dependency vulnerability and provenance scanning during release preparation. 8. If runtime checks remain necessary, make them diagnostic only and terminate with safe installation instructions instead of invoking pip. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mps_load_env.py:69
• Finding: Overbroad Discovery and Loading of Credential and Shell Configuration Files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mps_load_env.py:69-78, 81-145` **Vulnerability Type**: Excessive sensitive-file access and unsafe environment configuration discovery **Risk Level**: Medium ### Vulnerable Code ```python _ENV_FILES = [ os.path.expanduser("~/.env"), os.path.expanduser("~/.bashrc"), os.path.expanduser("~/.profile"), os.path.dirname(os.path.dirname(os.path.abspath(__file__))) ] ``` ```python def load_env_files(verbose: bool = False) -> dict: if not _DOTENV_AVAILABLE: return {} newly_loaded = {} seen_paths = set() def _load_and_collect(path_label, dotenv_path=None): before = dict(os.environ) try: ok = load_dotenv( dotenv_path=dotenv_path, override=False ) if dotenv_path else load_dotenv(override=False) except (OSError, IOError) as e: return for key, value in os.environ.items(): if key not in before: newly_loaded[key] = value try: from dotenv import find_dotenv default_path = find_dotenv(usecwd=True) except (ImportError, Exception): default_path = "" if default_path and os.path.isfile(default_path): _load_and_collect(f"Default .env: {default_path}") seen_paths.add(os.path.abspath(default_path)) for filepath in _ENV_FILES: if not filepath: continue abs_path = os.path.abspath(filepath) if abs_path in seen_paths: continue seen_paths.add(abs_path) if not os.path.isfile(filepath): continue _load_and_collect(filepath, dotenv_path=filepath) ``` ### Technical Analysis When required variables are missing, the loader searches from the current working directory through parent directories for the nearest `.env` file. It then attempts to parse user-wide `.env`, `.bashrc`, and `.profile` files. This behavior exceeds the ...[truncated 2556 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Stop parsing `~/.bashrc` and `~/.profile`; shell startup files are not appropriate credential stores for automatic application parsing. 2. Do not recursively discover `.env` files from the current working directory or its parents. 3. Load only an explicit, documented configuration file, such as `~/.config/tencent-mps-video-dubbing/env`, with restrictive filesystem permissions. 4. If Skill-local configuration is retained, construct the exact path `<SKILL_DIR>/.env` rather than passing the directory itself. 5. Parse the selected file without importing all entries into `os.environ`. 6. Copy only an allowlist of required names: - `TENCENTCLOUD_SECRET_ID` - `TENCENTCLOUD_SECRET_KEY` - `TENCENTCLOUD_COS_BUCKET` - `TENCENTCLOUD_COS_REGION` - `TENCENTCLOUD_API_REGION` - A validated endpoint value, if endpoint configuration is necessary 7. Require explicit user approval before reading any user-level credential file. 8. Document recommended file permissions, such as mode `0600`, and reject configuration files that are group- or world-writable. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mps_video_dubbing.py:137
• Finding: Unrestricted Environment-Controlled MPS API Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mps_video_dubbing.py:137-141`; `scripts/mps_poll_task.py:68-72` **Vulnerability Type**: Unvalidated network destination configuration **Risk Level**: Medium ### Vulnerable Code ```python http_profile = HttpProfile() http_profile.endpoint = os.environ.get( "TENCENTCLOUD_MPS_ENDPOINT", "mps.tencentcloudapi.com" ) client_profile = ClientProfile() client_profile.httpProfile = http_profile return mps_client.MpsClient(cred, region, client_profile) ``` The polling client uses the same unrestricted value: ```python http_profile = HttpProfile() http_profile.endpoint = os.environ.get( "TENCENTCLOUD_MPS_ENDPOINT", "mps.tencentcloudapi.com" ) http_profile.reqMethod = "POST" client_profile = ClientProfile() client_profile.httpProfile = http_profile return mps_client.MpsClient(cred, region, client_profile) ``` ### Technical Analysis The Skill permits `TENCENTCLOUD_MPS_ENDPOINT` to contain an arbitrary environment-controlled value. It does not enforce a hostname allowlist, validate that the destination belongs to Tencent Cloud, or reject IP addresses and unexpected domain names. This becomes more significant because `mps_load_env.py` can automatically discover `.env` files from the current directory and its parents. An attacker who controls such a file can set an endpoint used for both task submission and status polling. Tencent API authentication normally signs requests rather than sending the SecretKey directly. Therefore, this issue does not by itself prove disclosure of the raw SecretKey. However, request bodies, authorization metadata, timestamps, task identifiers, input locations, output locations, and other signed request data can be sent to the configured destination. Actual interception also depends on the Tencent SDK's TLS behavior and whether the configured endpoint can satisfy certificate validation. The lack of destination validation nevertheless creates an avoidable trust-boundary wea ...[truncated 1165 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Enforce an exact endpoint allowlist: - `mps.tencentcloudapi.com` - `mps.intl.tencentcloudapi.com` 2. Reject values containing URL schemes, paths, ports, IP literals, whitespace, user-information components, or unexpected suffixes. 3. Prefer a fixed endpoint selected through a constrained `domestic` or `international` option instead of accepting an arbitrary hostname. 4. Do not read endpoint configuration from automatically discovered project `.env` files. 5. Ensure TLS certificate and hostname verification remain enabled in the Tencent SDK. 6. Log the selected endpoint hostname before the first request, without logging authorization headers or credentials. 7. Apply the same validation function consistently to submission, query, and polling clients. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/mps_cos_upload.py:94
• Finding: Tencent Cloud Secret Credentials Accepted Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/mps_cos_upload.py:94-102, 223-224`; `scripts/mps_cos_download.py:95-103, 206-207` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Low ### Vulnerable Code ```python parser.add_argument( "--secret-id", default=None, help="Tencent Cloud SecretId; defaults to TENCENTCLOUD_SECRET_ID" ) parser.add_argument( "--secret-key", default=None, help="Tencent Cloud SecretKey; defaults to TENCENTCLOUD_SECRET_KEY" ) ``` ```python secret_id = args.secret_id or os.environ.get("TENCENTCLOUD_SECRET_ID") secret_key = args.secret_key or os.environ.get("TENCENTCLOUD_SECRET_KEY") ``` The download helper exposes the same interface: ```python parser.add_argument( "--secret-id", default=None, help="Tencent Cloud SecretId; defaults to TENCENTCLOUD_SECRET_ID" ) parser.add_argument( "--secret-key", default=None, help="Tencent Cloud SecretKey; defaults to TENCENTCLOUD_SECRET_KEY" ) ``` ```python secret_id = args.secret_id or os.environ.get("TENCENTCLOUD_SECRET_ID") secret_key = args.secret_key or os.environ.get("TENCENTCLOUD_SECRET_KEY") ``` ### Technical Analysis Command-line arguments are not a suitable channel for long-lived cloud credentials. Depending on the operating system and execution environment, complete process arguments may be visible through process-inspection facilities, Agent execution logs, monitoring systems, crash reports, shell history, or terminal transcripts. The main Skill documentation instructs users to configure credentials themselves and not disclose them to the Agent. Nevertheless, the internal upload and download helper interfaces explicitly advertise and accept `--secret-id` and `--secret-key`, creating an unsafe alternate path. No evidence shows that the scripts intentionally print these arguments. The exposure results from standard operating-system and tooling behavior around command invocation. ...[truncated 1100 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `--secret-id` and `--secret-key` from both helper scripts. 2. Obtain credentials only through a protected credential provider, securely injected environment variables, or a permission-restricted configuration file. 3. Prefer short-lived Tencent Cloud credentials or role-based temporary credentials over long-lived static keys. 4. Apply least-privilege IAM policies limited to the required MPS and COS operations and buckets. 5. Warn users not to place credentials in commands, chat messages, shell history, or logs. 6. Redact known credential patterns from Agent execution logs and diagnostic output. 7. Rotate any credential that has previously been passed through a command line or exposed in an Agent transcript. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (45)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill context says it should only handle end-to-end dubbing tasks or queries for those tasks, but the behavior appears to support generic MPS processing, COS upload/download, and broader output handling. That broader capability widens the attack surface and can let an attacker pivot from a narrowly approved workflow into arbitrary cloud-storage and task-management operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill context says it should only handle end-to-end dubbing tasks or queries for those tasks, but the behavior appears to support generic MPS processing, COS upload/download, and broader output handling. That broader capability widens the attack surface and can let an attacker pivot from a narrowly approved workflow into arbitrary cloud-storage and task-management operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill context says it should only handle end-to-end dubbing tasks or queries for those tasks, but the behavior appears to support generic MPS processing, COS upload/download, and broader output handling. That broader capability widens the attack surface and can let an attacker pivot from a narrowly approved workflow into arbitrary cloud-storage and task-management operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill context says it should only handle end-to-end dubbing tasks or queries for those tasks, but the behavior appears to support generic MPS processing, COS upload/download, and broader output handling. That broader capability widens the attack surface and can let an attacker pivot from a narrowly approved workflow into arbitrary cloud-storage and task-management operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill context says it should only handle end-to-end dubbing tasks or queries for those tasks, but the behavior appears to support generic MPS processing, COS upload/download, and broader output handling. That broader capability widens the attack surface and can let an attacker pivot from a narrowly approved workflow into arbitrary cloud-storage and task-management operations.

Credential Access

High

• Category: Privilege Escalation

Content

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 此外，load_env_files() 会先调用一次无参 load_dotenv()，
# 借助 find_dotenv(usecwd=True) 从当前工作目录向上递归查找最近的 .env 文件并加载。
_ENV_FILES = [
    os.path.expanduser("~/.env"),
    os.path.expanduser("~/.bashrc"),
    os.path.expanduser("~/.profile"),
    os.path.dirname(os.path.dirname(os.path.abspath(__file__)))

• Confidence: 94% confidence
• Finding: Including ~/.env in the automatic search path causes the skill to read secrets from a broad user-level location unrelated to the skill's own configuration boundary. In agent deployments, this can silently import unrelated credentials and make the skill depend on or expose ambient secrets present on the host.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def _load_and_collect(path_label, dotenv_path=None):
        """加载一个 dotenv 文件并收集新增变量。"""
        before = dict(os.environ)
        try:
            ok = load_dotenv(dotenv_path=dotenv_path, override=False) if dotenv_path else load_dotenv(override=False)
        except (OSError, IOError) as e:

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

return
        if verbose:
            print(f"[load_env] 加载文件: {path_label} ({'成功' if ok else '无变化'})", file=sys.stderr)
        for key, value in os.environ.items():
            if key not in before:
                newly_loaded[key] = value
                if verbose:

• Confidence: 84% confidence
• Finding: Iterating over all os.environ items after loading captures every newly introduced variable, not just the Tencent MPS variables needed by the skill. In a shared host context, this broad collection expands access to unrelated secrets and can expose their names and masked values in verbose logs, increasing the blast radius of accidental secret handling.

Credential Access

High

• Category: Privilege Escalation

Content

_load_and_collect(f"默认 .env: {default_path}")
        seen_paths.add(os.path.abspath(default_path))
    elif verbose:
        print("[load_env] 未在当前目录或上级目录找到默认 .env", file=sys.stderr)

    for filepath in _ENV_FILES:
        if not filepath:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

_load_and_collect(f"默认 .env: {default_path}")
        seen_paths.add(os.path.abspath(default_path))
    elif verbose:
        print("[load_env] 未在当前目录或上级目录找到默认 .env", file=sys.stderr)

    for filepath in _ENV_FILES:
        if not filepath:

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares shell, environment, and file-read capabilities through its behavior but does not explicitly scope or constrain those permissions. This creates an authorization gap: a caller or orchestrator may allow broader access than users expect, including reading local config files and invoking commands that can modify the runtime environment.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The file contains user-facing response requirements in Chinese, including a mandated output format for TaskId and a required natural-language charge confirmation flow, but it does not offer the user any language choice or opt-in. This creates a locale/language policy issue because the skill appears to require Chinese output regardless of the user's preferred language.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This Python file contains all natural-language documentation and runtime status/error messages in Chinese, including the main docstring and user-visible stderr output. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless a locale-specific constraint is explicitly justified, which is not present here.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code automatically installs or upgrades Python packages at runtime using pip based on requirements.txt, which creates an unnecessary supply-chain and integrity risk for a video dubbing skill. A compromised package source, altered requirements file, or unexpected dependency resolution could execute untrusted code in the agent environment, and this behavior exceeds what users would reasonably expect from media localization functionality.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""
    cmd = [sys.executable, "-m", "pip", "install", "--upgrade", "--quiet"] + specs
    print(f"⏳ 正在自动安装/升级缺失依赖：{', '.join(specs)}", file=sys.stderr)
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(
            f"❌ 自动安装失败，请手动执行:\n"

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:41