Tencent MPS Video Dubbing

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:47 AM UTC
• Version: 1.0.6

Overview

This video dubbing skill appears purpose-aligned, but it automatically changes the Python environment and broadly loads local credential/config files while handling paid Tencent Cloud access.

Install only if you are comfortable giving it Tencent Cloud credentials and letting it upload/download video files through COS. Use least-privilege, preferably temporary Tencent credentials; avoid putting secrets in command arguments; do not run it from untrusted directories; and consider disabling the auto-upgrade behavior or installing pinned dependencies in a separate virtual environment first.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: scripts/mps_auto_upgrade.py:106

Finding

Automatic Installation and Upgrade of Unpinned Runtime Dependencies

Content

View full analysis

={min_ver_str}" if min_ver_str else pkg_name try: installed_ver = _pkg_version(pkg_name) except PackageNotFoundError: to_install.append(spec) continue if min_ver and _ver_tuple(installed_ver) < min_ver: to_install.append(spec) if to_install: _pip_install(to_install) ``` ```text tencentcloud-sdk-python>=3.1.139 cos-python-sdk-v5>=1.9.30 python-dotenv>=1.0.0 ``` ### Technical Analysis Normal Skill execution calls `check_sdk_version()` before importing the Tencent Cloud, COS, and dotenv libraries. If a package is missing or below the minimum version, the process automatically invokes pip and installs the newest version satisfying an open-ended lower-bound constraint. The dependencies are not pinned to reviewed versions and are not protected with package hashes. Consequently, the ...[truncated 1791 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mps_load_env.py:69

Finding

Overbroad Discovery and Loading of Credential and Shell Configuration Files

Content

View full analysis

dict: if not _DOTENV_AVAILABLE: return {} newly_loaded = {} seen_paths = set() def _load_and_collect(path_label, dotenv_path=None): before = dict(os.environ) try: ok = load_dotenv( dotenv_path=dotenv_path, override=False ) if dotenv_path else load_dotenv(override=False) except (OSError, IOError) as e: return for key, value in os.environ.items(): if key not in before: newly_loaded[key] = value try: from dotenv import find_dotenv default_path = find_dotenv(usecwd=True) except (ImportError, Exception): default_path = "" if default_path and os.path.isfile(default_path): _load_and_collect(f"Default .env: {default_path}") seen_paths.add(os.path.abspath(default_path)) for filepath in _ENV_FILES: if not filepath: continue abs_path = os.path.abspath(filepath) if abs_path in seen_paths: continue seen_paths.add(abs_path) if not os.path.isfile(filepath): continue _load_and_collect(filepath, dotenv_path=filepath) ``` ### Technical Analysis When required variables are missing, the loader searches from the current working directory through parent directories for the nearest `.env` file. It then attempts to parse user-wide `.env`, `.bashrc`, and `.profile` files. This behavior exceeds the ...[truncated 2556 chars]

Remediation

View remediation

/.env` rather than passing the directory itself. 5. Parse the selected file without importing all entries into `os.environ`. 6. Copy only an allowlist of required names: - `TENCENTCLOUD_SECRET_ID` - `TENCENTCLOUD_SECRET_KEY` - `TENCENTCLOUD_COS_BUCKET` - `TENCENTCLOUD_COS_REGION` - `TENCENTCLOUD_API_REGION` - A validated endpoint value, if endpoint configuration is necessary 7. Require explicit user approval before reading any user-level credential file. 8. Document recommended file permissions, such as mode `0600`, and reject configuration files that are group- or world-writable. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/mps_video_dubbing.py:137

Finding

Unrestricted Environment-Controlled MPS API Endpoint

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/mps_cos_upload.py:94

Finding

Tencent Cloud Secret Credentials Accepted Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (45)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill context says it should only handle end-to-end dubbing tasks or queries for those tasks, but the behavior appears to support generic MPS processing, COS upload/download, and broader output handling. That broader capability widens the attack surface and can let an attacker pivot from a narrowly approved workflow into arbitrary cloud-storage and task-management operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill context says it should only handle end-to-end dubbing tasks or queries for those tasks, but the behavior appears to support generic MPS processing, COS upload/download, and broader output handling. That broader capability widens the attack surface and can let an attacker pivot from a narrowly approved workflow into arbitrary cloud-storage and task-management operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill context says it should only handle end-to-end dubbing tasks or queries for those tasks, but the behavior appears to support generic MPS processing, COS upload/download, and broader output handling. That broader capability widens the attack surface and can let an attacker pivot from a narrowly approved workflow into arbitrary cloud-storage and task-management operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill context says it should only handle end-to-end dubbing tasks or queries for those tasks, but the behavior appears to support generic MPS processing, COS upload/download, and broader output handling. That broader capability widens the attack surface and can let an attacker pivot from a narrowly approved workflow into arbitrary cloud-storage and task-management operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill context says it should only handle end-to-end dubbing tasks or queries for those tasks, but the behavior appears to support generic MPS processing, COS upload/download, and broader output handling. That broader capability widens the attack surface and can let an attacker pivot from a narrowly approved workflow into arbitrary cloud-storage and task-management operations.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mps_load_env.py (reported line 8)May include surrounding context.

python

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mps_load_env.py (reported line 9)May include surrounding context.

python

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mps_load_env.py (reported line 12)May include surrounding context.

python

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mps_load_env.py (reported line 71)May include surrounding context.

python

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mps_load_env.py (reported line 89)May include surrounding context.

python

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mps_load_env.py (reported line 116)May include surrounding context.

python

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mps_load_env.py (reported line 178)May include surrounding context.

python

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mps_load_env.py (reported line 180)May include surrounding context.

python

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mps_video_dubbing.py (reported line 793)May include surrounding context.

python

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/requirements.txt (reported line 17)May include surrounding context.

text

实现说明：
  使用 python-dotenv 库的 load_dotenv 函数加载 dotenv 风格的配置文件。
  按以下顺序加载（已存在的环境变量不会被覆盖，先加载者优先）：
    1. 默认行为：通过 find_dotenv(usecwd=True) 从当前目录向上递归找最近的 .env 并加载
    2. ~/.env                （用户级 dotenv）
    3. ~/.bashrc             （shell 启动文件，兼容 export VAR=... 写法）
    4. ~/.profile            （登录 shell 启动文件）

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Including ~/.env in the automatic search path causes the skill to read secrets from a broad user-level location unrelated to the skill's own configuration boundary. In agent deployments, this can silently import unrelated credentials and make the skill depend on or expose ambient secrets present on the host.

Content

Scanner excerpt · scripts/mps_load_env.py (reported line 73)May include surrounding context.

python

# 此外，load_env_files() 会先调用一次无参 load_dotenv()，
# 借助 find_dotenv(usecwd=True) 从当前工作目录向上递归查找最近的 .env 文件并加载。
_ENV_FILES = [
    os.path.expanduser("~/.env"),
    os.path.expanduser("~/.bashrc"),
    os.path.expanduser("~/.profile"),
    os.path.dirname(os.path.dirname(os.path.abspath(__file__)))

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/mps_load_env.py (reported line 100)May include surrounding context.

python

def _load_and_collect(path_label, dotenv_path=None):
        """加载一个 dotenv 文件并收集新增变量。"""
        before = dict(os.environ)
        try:
            ok = load_dotenv(dotenv_path=dotenv_path, override=False) if dotenv_path else load_dotenv(override=False)
        except (OSError, IOError) as e:

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

Iterating over all os.environ items after loading captures every newly introduced variable, not just the Tencent MPS variables needed by the skill. In a shared host context, this broad collection expands access to unrelated secrets and can expose their names and masked values in verbose logs, increasing the blast radius of accidental secret handling.

Content

Scanner excerpt · scripts/mps_load_env.py (reported line 109)May include surrounding context.

python

return
        if verbose:
            print(f"[load_env] 加载文件: {path_label} ({'成功' if ok else '无变化'})", file=sys.stderr)
        for key, value in os.environ.items():
            if key not in before:
                newly_loaded[key] = value
                if verbose:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mps_load_env.py (reported line 127)May include surrounding context.

python

_load_and_collect(f"默认 .env: {default_path}")
        seen_paths.add(os.path.abspath(default_path))
    elif verbose:
        print("[load_env] 未在当前目录或上级目录找到默认 .env", file=sys.stderr)

    for filepath in _ENV_FILES:
        if not filepath:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mps_load_env.py (reported line 306)May include surrounding context.

python

_load_and_collect(f"默认 .env: {default_path}")
        seen_paths.add(os.path.abspath(default_path))
    elif verbose:
        print("[load_env] 未在当前目录或上级目录找到默认 .env", file=sys.stderr)

    for filepath in _ENV_FILES:
        if not filepath:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares shell, environment, and file-read capabilities through its behavior but does not explicitly scope or constrain those permissions. This creates an authorization gap: a caller or orchestrator may allow broader access than users expect, including reading local config files and invoking commands that can modify the runtime environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file contains user-facing response requirements in Chinese, including a mandated output format for TaskId and a required natural-language charge confirmation flow, but it does not offer the user any language choice or opt-in. This creates a locale/language policy issue because the skill appears to require Chinese output regardless of the user's preferred language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python file contains all natural-language documentation and runtime status/error messages in Chinese, including the main docstring and user-visible stderr output. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless a locale-specific constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code automatically installs or upgrades Python packages at runtime using pip based on requirements.txt, which creates an unnecessary supply-chain and integrity risk for a video dubbing skill. A compromised package source, altered requirements file, or unexpected dependency resolution could execute untrusted code in the agent environment, and this behavior exceeds what users would reasonably expect from media localization functionality.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mps_auto_upgrade.py (reported line 113)May include surrounding context.

python

"""
    cmd = [sys.executable, "-m", "pip", "install", "--upgrade", "--quiet"] + specs
    print(f"⏳ 正在自动安装/升级缺失依赖：{', '.join(specs)}", file=sys.stderr)
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(
            f"❌ 自动安装失败，请手动执行:\n"