Tencent VOD Intl.

• Outcome: Review
• Latest audit: Aug 9, 2026 · 1:47 PM UTC
• Version: 1.1.3

Overview

The skill is mostly aligned with Tencent VOD workflows, but it automatically modifies local packages and persists or loads cloud credentials in ways users should review before installing.

Review this skill before installing. It can generate commands that upload media, submit billable Tencent Cloud processing/AIGC jobs, query account media metadata, create/delete AIGC tokens, auto-install or upgrade Python packages, load credentials from .env files, and save tokens or element metadata locally. Use dry-run first, run it only in a trusted Python environment, keep Tencent credentials in a dedicated dotenv file, and avoid sending confidential or biometric media unless you are authorized to process it in Tencent Cloud.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (65)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""
    cmd = [sys.executable, "-m", "pip", "install", "--upgrade", "--quiet"] + specs
    print(f"⏳ Auto-installing/upgrading missing dependencies: {', '.join(specs)}", file=sys.stderr)
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(
            f"❌ Auto-install failed, please run manually:\n"

• Confidence: 97% confidence
• Finding: This subprocess call launches `pip install --upgrade` on the host at runtime, which changes the local environment and executes package installation logic outside the stated VOD command-generation purpose. Although it avoids shell injection by passing an argument list, it still introduces host-side code execution and supply-chain risk because package resolution and install scripts may run automatically.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The skill's declared purpose says it is a command-generation assistant and explicitly excludes some operation classes, yet the analyzed behavior indicates direct API execution/upload flows and MPS-related handling beyond that stated scope. This mismatch is dangerous because users and policy layers may rely on the description to assess trust boundaries, while the actual skill can trigger billable, networked, or broader media-processing actions than expected.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The documentation exposes generic tool/function-calling capabilities that are unrelated to the stated VOD command-generation scope. In an agent-skill context, this broadens user and model expectations, increasing the chance the skill is invoked as a general-purpose agent that can orchestrate external actions or produce out-of-scope commands, which weakens security boundaries and can enable prompt-scope confusion.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The examples repeatedly present the skill as a general chat, reasoning, multimodal, and content-generation assistant rather than a narrowly scoped VOD command generator. This mismatch can cause over-triggering and unsafe reliance on the skill for unrelated tasks, undermining least-privilege design and making prompt injection or misuse more likely because the skill appears to authorize broad model behavior.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The reference explicitly documents `mpsAiMediaInfo` as an allowed filter and describes MPS AI media query behavior, while the skill metadata says MPS operations must not trigger. This creates scope-confusion: an agent using this reference could incorrectly invoke or suggest prohibited MPS-related functionality, undermining policy boundaries and potentially causing unauthorized or unintended API use.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The response schema exposes `MPSAi Media Info` fields in a skill that declares MPS operations are out of scope. Even though this is documentation, it can train or prompt an agent to expect and surface prohibited data structures, increasing the likelihood of forbidden feature use and leakage of out-of-scope operational capability.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The examples provide concrete commands for querying MPS AI media information, which materially lowers the barrier for an agent or user to perform disallowed MPS-related actions despite the manifest prohibition. In an agent setting, executable-looking examples are especially influential and can directly drive incorrect tool selection or command generation.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly lists `ProcessMediaByMPS` as a supported task type even though the skill metadata says MPS operations must not trigger this skill. That inconsistency can cause the agent to route or assist with out-of-scope MPS operations, weakening intended safety boundaries and potentially causing unauthorized or incorrect command generation.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The script persists newly created AIGC tokens into local dotenv files automatically, which expands the secret's exposure surface beyond the immediate process. Storing long-lived tokens in ~/.env or the current working directory without explicit opt-in can leak credentials to other local users, backups, shell tooling, or accidental source control commits.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code enumerates candidate dotenv files and rewrites them to insert a secret token, giving the tool filesystem secret-management behavior in addition to API token operations. That capability is risky because it modifies user configuration files implicitly and may overwrite or duplicate sensitive settings in locations not intended for automated secret persistence.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The skill performs package installation and upgrades on the host even though its declared role is assisting with Tencent VOD commands. That behavior exceeds the minimum privileges needed, can modify the execution environment without user consent, and may trigger download/execution of untrusted or changing package artifacts from package indexes.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documentation presents the module as a compatibility helper, but it actually performs automatic host modification by upgrading packages. This mismatch is security-relevant because it obscures a side effect operators may not expect, reducing informed consent and making risky behavior easier to smuggle into an otherwise narrow-purpose skill.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: A query-oriented script unexpectedly writes AIGC custom element results into a shared local file under `mem/elements.json`. This creates silent persistence of potentially sensitive task output, increases data-retention risk, and can mix results across users/tasks without clear isolation or consent.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The loader searches upward from the current working directory and imports the first `.env` it finds, then also loads `~/.env` and `./.env`, pulling in all variables from those files into the process. In a command-generation skill, this is broader than necessary and can cause the skill to trust attacker-controlled or unrelated parent-directory configuration, especially when run from an untrusted workspace or nested repository.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The script prints live-recording, TRTC recording, and webpage recording source details in verbose mode, including domains, paths, stream IDs, room IDs, user IDs, task IDs, and record URLs. In the context of a skill whose manifest explicitly says it should not trigger for live streaming, exposing these fields expands into adjacent operational data that may reveal sensitive infrastructure or identifiers unrelated to the requested VOD search.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The script surfaces MPS AI media information even though the skill metadata states MPS operations should not trigger this skill. While it only reports counts, this still exposes out-of-scope processing activity and weakens the boundary promised by the manifest, which can confuse users and leak information about adjacent services in the same account.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The documentation encourages saving model responses to disk without warning that outputs may contain sensitive prompts, user data, API-returned metadata, or generated content derived from private inputs. In operational environments, this can lead to inadvertent persistence of sensitive material in shared paths, logs, or artifacts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The examples instruct users to send image, audio, and video data to remote models without clearly warning that these assets may contain personal, confidential, or regulated information. Because multimodal uploads often include highly sensitive content, omission of privacy guidance materially increases the risk of accidental data disclosure to third-party model processing endpoints.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The documentation instructs users to provide remote reference-image URLs and other request parameters to Tencent Cloud without any privacy or data-transmission warning. This can lead users to unintentionally send sensitive internal URLs, personal images, or proprietary data to a third-party service, especially because the skill is specifically designed to broker media-generation requests to a remote cloud API.

Missing User Warnings

Low

• Confidence: 96% confidence
• Finding: The `--session-context` parameter explicitly says it can pass through user request information, but the documentation does not warn that this data may be sent to the remote service and persisted in logs or task metadata. Because users may place prompts, identifiers, or sensitive business context there, the omission creates a real privacy and data-handling risk through accidental disclosure.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation encourages passing user-controlled media URLs, file IDs, and session context into a cloud video-generation workflow without any explicit warning about sensitive data handling, retention, or cross-border transfer implications. In a VOD/AIGC skill, this is materially risky because users may supply personal images, videos, audio, or contextual text that contains confidential or regulated data.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The avatar, lip-sync, motion-control, and editing examples explicitly involve uploading portraits, face data, voice audio, and source videos, yet they do not warn about biometric data, consent, impersonation, or privacy obligations. In this context, omission is more dangerous than in generic media processing because these features directly process identity-linked content and can enable deepfake-style manipulation if used without user awareness or authorization controls.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly states that successful creations are appended to a local persistent file and includes storage of user-supplied fields such as session_context, element descriptions, URLs, and identifiers, but it provides no privacy warning, retention guidance, access controls, or minimization advice. In a VOD/AIGC workflow, these fields can contain sensitive business data, user prompts, media references, or internal metadata, so silent persistence increases the risk of unintended disclosure on shared systems or through later log/file access.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The documentation encourages `--verbose` and `--json` output and notes that verbose mode may include output URLs and full API responses, but it does not warn that these fields may contain sensitive or internal data. In shared terminals, logs, chat transcripts, or agent outputs, this can lead to accidental disclosure of media URLs, identifiers, or metadata.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to submit media for large-model understanding features that include ASR and summarization, but it does not warn that uploaded content may be transmitted to cloud processing services and analyzed for speech/content extraction. In a command-generation skill, this omission can cause users to process sensitive audio/video without realizing the privacy, compliance, or consent implications, especially for regulated or confidential media.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.