Tencent VOD Intl.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:30 AM UTC
• Version: 1.1.3

Overview

The skill appears to be a real Tencent VOD helper, but it needs Review because it can automatically install packages and handles long-lived cloud tokens in unsafe local files and command output.

Use this only in a dedicated virtual environment with least-privilege Tencent Cloud credentials and expect billable VOD/AIGC actions. Avoid creating or listing tokens in logged agent, CI, or shared terminal sessions; store tokens in a secure secret manager if possible, rotate any exposed token, and review or disable the auto-upgrade helper before running scripts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/vod_auto_upgrade.py:44

Finding

Automatic Runtime Installation of Unpinned Dependencies

Content

View full analysis

=3.1.107", "requests>=2.31.0"] """ cmd = [sys.executable, "-m", "pip", "install", "--upgrade", "--quiet"] + specs print(f"⏳ Auto-installing/upgrading missing dependencies: {', '.join(specs)}", file=sys.stderr) result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print( f"❌ Auto-install failed, please run manually:\n" f" python3 -m pip install --upgrade {' '.join(repr(s) for s in specs)}\n" f" Error: {result.stderr.strip()}", file=sys.stderr, ) sys.exit(1) print("✅ Install complete", file=sys.stderr) def check_sdk_version(): """Check all dependencies in requirements.txt; auto-install/upgrade if missing or too old.""" to_install = [] for pkg_name, min_ver in _DEPENDENCIES: min_ver_str = ".".join(map(str, min_ver)) if min_ver else None spec = f"{pkg_name}>={min_ver_str}" if min_ver_str else pkg_name try: installed_ver = _pkg_version(pkg_name) except PackageNotFoundError: print(f"⚠️ {pkg_name} not installed", file=sys.stderr) to_install.append(spec) continue if min_ver and _ver_tuple(installed_ver) < min_ver: print( f"⚠️ {pkg_name} version too low: {i ...[truncated 2754 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/vod_aigc_token.py:172

Finding

Non-Expiring API Token Persisted Without Secure File Handling

Content

View full analysis

bool: """ Update or append TENCENTCLOUD_VOD_AIGC_TOKEN in the specified file. If the line already exists in the file, replace it; otherwise append. Returns True on success. """ try: lines = [] if os.path.exists(filepath): with open(filepath, "r", encoding="utf-8", errors="replace") as f: lines = f.readlines() new_lines = [] found = False for line in lines: stripped = line.strip() if re.match(rf"""^\s*(?:export\s+)?{_TOKEN_KEY}\s*=""", stripped): new_lines.append(f'export {_TOKEN_KEY}="{token}"\n') found = True else: new_lines.append(line) if not found: if new_lines and not new_lines[-1].endswith("\n"): new_lines.append("\n") new_lines.append(f'export {_TOKEN_KEY}="{token}"\n') with open(filepath, "w", encoding="utf-8") as f: f.writelines(new_lines) return True except Exception as e: print(f"⚠️ Failed to write to {filepath}: {e}", file=sys.stderr) return False def find_token_in_env_files() -> list: """ Scan all candidate config files and return a list of file paths containing TENCENTCLOUD_VOD_AIGC_TOKEN. """ found_files = [] token_re = re.compile(rf"""^\s*(?:export\s+)?{_TOKEN_KEY}\s*=""") for filepath in _ALL_ENV_FILES: if not os.path.isfile(filepath): continue try: with open(filepath, "r", encoding="utf-8", errors="replace") as f: for line in f: if token_re.match(line): found_files.append(filepath) ...[truncated 3563 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/vod_aigc_token.py:251

Finding

Complete Non-Expiring API Tokens Exposed Through Command Output

Content

View full analysis

12 else t print(f" [{i}] Token : {masked}") else ...[truncated 2415 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (181)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This broad description-to-behavior gap suggests the skill advertises many capabilities it may not actually implement while also enabling direct API execution instead of mere command generation. Such ambiguity is dangerous because it undermines trust boundaries, can mislead automation into granting excessive privileges, and may trigger billable or state-changing cloud actions under the guise of harmless assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This broad description-to-behavior gap suggests the skill advertises many capabilities it may not actually implement while also enabling direct API execution instead of mere command generation. Such ambiguity is dangerous because it undermines trust boundaries, can mislead automation into granting excessive privileges, and may trigger billable or state-changing cloud actions under the guise of harmless assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This broad description-to-behavior gap suggests the skill advertises many capabilities it may not actually implement while also enabling direct API execution instead of mere command generation. Such ambiguity is dangerous because it undermines trust boundaries, can mislead automation into granting excessive privileges, and may trigger billable or state-changing cloud actions under the guise of harmless assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This broad description-to-behavior gap suggests the skill advertises many capabilities it may not actually implement while also enabling direct API execution instead of mere command generation. Such ambiguity is dangerous because it undermines trust boundaries, can mislead automation into granting excessive privileges, and may trigger billable or state-changing cloud actions under the guise of harmless assistance.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

Enumerating candidate dotenv files is part of the local secret persistence workflow, which expands the script's reach into user configuration files. In this skill context, a VOD token tool that scans and later writes to ~/.env and the current directory .env increases the chance of secrets being placed in insecure or unexpected locations.

Content

Scanner excerpt · scripts/vod_aigc_token.py (reported line 164)May include surrounding context.

python

# Candidate dotenv file paths (consistent with vod_load_env._ENV_FILES; only dotenv-style files are scanned)
_ALL_ENV_FILES = [
    os.path.expanduser("~/.env"),
    os.path.join(os.getcwd(), ".env"),
]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 89% confidence

Finding

Including the current working directory .env as a target for token-related scanning/persistence is risky because project directories are more likely to be shared, backed up, or committed to source control. That makes long-lived API tokens easier to expose accidentally.

Content

Scanner excerpt · scripts/vod_aigc_token.py (reported line 165)May include surrounding context.

python

# Candidate dotenv file paths (consistent with vod_load_env._ENV_FILES; only dotenv-style files are scanned)
_ALL_ENV_FILES = [
    os.path.expanduser("~/.env"),
    os.path.join(os.getcwd(), ".env"),
]

_TOKEN_KEY = "TENCENTCLOUD_VOD_AIGC_TOKEN"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

Defaulting secret writes to ~/.env codifies plaintext persistence of a long-lived API token. Even though the file is user-scoped, plaintext credential storage can leak via lax permissions, shell tooling, backups, or other local processes and is riskier than the assistant's nominal token-management scope requires.

Content

Scanner excerpt · scripts/vod_aigc_token.py (reported line 169)May include surrounding context.

python

]

_TOKEN_KEY = "TENCENTCLOUD_VOD_AIGC_TOKEN"
_DEFAULT_ENV_FILE = os.path.expanduser("~/.env")


def _update_token_in_file(filepath: str, token: str) -> bool:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The logic explicitly defaults to writing the new token into ~/.env when no existing token entry is found, meaning secret persistence occurs automatically with no explicit destination selection by the user. This creates unnecessary credential exposure for a long-lived token and surprises users with a sensitive filesystem side effect.

Content

Scanner excerpt · scripts/vod_aigc_token.py (reported line 240)May include surrounding context.

python

target_files = find_token_in_env_files()

    if not target_files:
        # No files have the config, default to writing to ~/.env
        target_files = [_DEFAULT_ENV_FILE]

    written = []

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The fallback to loading credentials from .env files indicates the script may access locally stored secrets beyond explicit runtime parameters. In an agent skill, this is particularly sensitive because it broadens the trust boundary to host-local secret material and can enable cloud actions under credentials the user did not consciously provide for this invocation.

Content

Scanner excerpt · scripts/vod_aigc_video.py (reported line 43)May include surrounding context.

python

secret_key = os.environ.get("TENCENTCLOUD_SECRET_KEY")

    if not secret_id or not secret_key:
        # Fallback: try to load credentials from ~/.env etc.
        if _LOAD_ENV_AVAILABLE:
            print("[load_env] Environment variables not set, attempting to load from dotenv files...", file=sys.stderr)
            _ensure_env_loaded(verbose=True)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The code intentionally loads .env values early so argument defaults can inherit host configuration, including sub-app identifiers and potentially credentials via the shared loader path. This reinforces implicit secret/config consumption from the local environment, which is inconsistent with a safer command-only assistant model.

Content

Scanner excerpt · scripts/vod_aigc_video.py (reported line 546)May include surrounding context.

python

def main():
    check_sdk_version()
    # Load .env early so that `argparse default=os.environ.get(...)` sees the values.
    # Bug fix: previously SubAppId default was evaluated at add_argument time,
    # but .env was loaded inside get_credential() — too late, causing SubAppId=None.
    if _LOAD_ENV_AVAILABLE:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Calling the dotenv loader at startup causes the script to ingest local configuration before argument parsing, creating implicit dependence on host secrets/configuration. While not exfiltration by itself, it is credential-access behavior that increases the risk of unauthorized or surprising use of privileged cloud context.

Content

Scanner excerpt · scripts/vod_aigc_video.py (reported line 548)May include surrounding context.

python

check_sdk_version()
    # Load .env early so that `argparse default=os.environ.get(...)` sees the values.
    # Bug fix: previously SubAppId default was evaluated at add_argument time,
    # but .env was loaded inside get_credential() — too late, causing SubAppId=None.
    if _LOAD_ENV_AVAILABLE:
        try:
            _ensure_env_loaded(verbose=False)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/vod_create_aigc_advanced_custom_element.py (reported line 158)May include surrounding context.

python

if not val:
        if required:
            print("  ⚠️  This field is required. Please enter a value.")
            return prompt_list_input(prompt_text, required=True)
        return []
    return [v.strip() for v in val.split(",") if v.strip()]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/requirements.txt (reported line 17)May include surrounding context.

text

configuration files. Loaded in the following order (existing environment
  variables will not be overwritten; the first to load wins):
    1. Default behavior: find_dotenv(usecwd=True) recursively searches upward
       from the current directory for the nearest .env file and loads it.
    2. ~/.env                (user-level dotenv, highest priority)
    3. ./.env                (current working directory dotenv)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_aigc_audio.py (reported line 20)May include surrounding context.

python

configuration files. Loaded in the following order (existing environment
  variables will not be overwritten; the first to load wins):
    1. Default behavior: find_dotenv(usecwd=True) recursively searches upward
       from the current directory for the nearest .env file and loads it.
    2. ~/.env                (user-level dotenv, highest priority)
    3. ./.env                (current working directory dotenv)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_aigc_audio.py (reported line 46)May include surrounding context.

python

configuration files. Loaded in the following order (existing environment
  variables will not be overwritten; the first to load wins):
    1. Default behavior: find_dotenv(usecwd=True) recursively searches upward
       from the current directory for the nearest .env file and loads it.
    2. ~/.env                (user-level dotenv, highest priority)
    3. ./.env                (current working directory dotenv)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_aigc_audio.py (reported line 344)May include surrounding context.

python

configuration files. Loaded in the following order (existing environment
  variables will not be overwritten; the first to load wins):
    1. Default behavior: find_dotenv(usecwd=True) recursively searches upward
       from the current directory for the nearest .env file and loads it.
    2. ~/.env                (user-level dotenv, highest priority)
    3. ./.env                (current working directory dotenv)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_aigc_chat.py (reported line 85)May include surrounding context.

python

configuration files. Loaded in the following order (existing environment
  variables will not be overwritten; the first to load wins):
    1. Default behavior: find_dotenv(usecwd=True) recursively searches upward
       from the current directory for the nearest .env file and loads it.
    2. ~/.env                (user-level dotenv, highest priority)
    3. ./.env                (current working directory dotenv)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_aigc_chat.py (reported line 97)May include surrounding context.

python

configuration files. Loaded in the following order (existing environment
  variables will not be overwritten; the first to load wins):
    1. Default behavior: find_dotenv(usecwd=True) recursively searches upward
       from the current directory for the nearest .env file and loads it.
    2. ~/.env                (user-level dotenv, highest priority)
    3. ./.env                (current working directory dotenv)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_aigc_image.py (reported line 43)May include surrounding context.

python

configuration files. Loaded in the following order (existing environment
  variables will not be overwritten; the first to load wins):
    1. Default behavior: find_dotenv(usecwd=True) recursively searches upward
       from the current directory for the nearest .env file and loads it.
    2. ~/.env                (user-level dotenv, highest priority)
    3. ./.env                (current working directory dotenv)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_aigc_image.py (reported line 354)May include surrounding context.

python

configuration files. Loaded in the following order (existing environment
  variables will not be overwritten; the first to load wins):
    1. Default behavior: find_dotenv(usecwd=True) recursively searches upward
       from the current directory for the nearest .env file and loads it.
    2. ~/.env                (user-level dotenv, highest priority)
    3. ./.env                (current working directory dotenv)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_aigc_image.py (reported line 356)May include surrounding context.

python

configuration files. Loaded in the following order (existing environment
  variables will not be overwritten; the first to load wins):
    1. Default behavior: find_dotenv(usecwd=True) recursively searches upward
       from the current directory for the nearest .env file and loads it.
    2. ~/.env                (user-level dotenv, highest priority)
    3. ./.env                (current working directory dotenv)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_aigc_token.py (reported line 33)May include surrounding context.

python

configuration files. Loaded in the following order (existing environment
  variables will not be overwritten; the first to load wins):
    1. Default behavior: find_dotenv(usecwd=True) recursively searches upward
       from the current directory for the nearest .env file and loads it.
    2. ~/.env                (user-level dotenv, highest priority)
    3. ./.env                (current working directory dotenv)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_aigc_token.py (reported line 59)May include surrounding context.

python

configuration files. Loaded in the following order (existing environment
  variables will not be overwritten; the first to load wins):
    1. Default behavior: find_dotenv(usecwd=True) recursively searches upward
       from the current directory for the nearest .env file and loads it.
    2. ~/.env                (user-level dotenv, highest priority)
    3. ./.env                (current working directory dotenv)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_aigc_token.py (reported line 60)May include surrounding context.

python

configuration files. Loaded in the following order (existing environment
  variables will not be overwritten; the first to load wins):
    1. Default behavior: find_dotenv(usecwd=True) recursively searches upward
       from the current directory for the nearest .env file and loads it.
    2. ~/.env                (user-level dotenv, highest priority)
    3. ./.env                (current working directory dotenv)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_aigc_token.py (reported line 71)May include surrounding context.

python

configuration files. Loaded in the following order (existing environment
  variables will not be overwritten; the first to load wins):
    1. Default behavior: find_dotenv(usecwd=True) recursively searches upward
       from the current directory for the nearest .env file and loads it.
    2. ~/.env                (user-level dotenv, highest priority)
    3. ./.env                (current working directory dotenv)

Static analysis

No suspicious patterns detected.