Tencent VOD

• Outcome: Review
• Latest audit: Jul 5, 2026 · 5:01 PM UTC
• Version: 1.1.1

Overview

This Tencent VOD skill appears service-focused, but it can automatically change the local Python environment and persist cloud tokens/data in ways users should review before installing.

Review before installing. Use a dedicated Python environment, preinstall dependencies yourself, and avoid letting runtime scripts auto-upgrade packages. Use least-privilege Tencent Cloud credentials, avoid sending sensitive media, internal URLs, secrets, or personal data, and inspect ~/.env, project .env, and mem/elements.json for persisted tokens or task metadata. Treat token deletion and billable processing commands as operations that need explicit human confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (45)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""
    cmd = [sys.executable, "-m", "pip", "install", "--upgrade", "--quiet"] + specs
    print(f"⏳ 正在自动安装/升级缺失依赖：{', '.join(specs)}", file=sys.stderr)
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(
            f"❌ 自动安装失败，请手动执行:\n"

• Confidence: 95% confidence
• Finding: result = subprocess.run(cmd, capture_output=True, text=True)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill instructs the agent to use environment variables, read reference files, write local state such as mem/elements.json, access networked Tencent Cloud APIs, and generate shell commands, yet it declares no permissions boundary. This mismatch can cause the platform or reviewers to underestimate the skill's effective capabilities, increasing the chance of unintended data access or command generation in a sensitive environment.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script modifies local dotenv files to persist a newly created long-lived API token, which expands its behavior from remote token management into local credential persistence. Persisting secrets to ~/.env or project .env files increases the chance of accidental exposure through weak filesystem permissions, shell history/workspace leakage, backups, or source control inclusion.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code scans multiple local .env locations and updates every file containing the token variable, which is broader access to local credential stores than required for basic VOD command execution. This behavior can unexpectedly alter unrelated working directories and silently spread a sensitive token across more files than the user intended.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: A VOD command-generation assistant should not silently perform host package management as part of normal operation. This expands the skill's privileges beyond its declared purpose and creates an unnecessary supply-chain and environment-integrity risk surface.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill can execute package-management subprocesses on the host, a powerful capability unrelated to generating VOD commands. In this context, that means normal use of the skill can trigger network access, package downloads, and installation-time code execution from third-party packages, which materially increases risk.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module is described as a dependency check, but it actually mutates the environment by auto-upgrading packages. This mismatch can mislead reviewers and operators, reducing informed consent and making risky behavior more likely to be imported broadly across scripts.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The script is presented as a task-detail query tool, but it performs a side effect by writing AIGC custom element results to a local mem/elements.json file. That can unexpectedly persist potentially sensitive generated metadata or identifiers on disk, creating confidentiality and data-governance risks, especially in shared or multi-user environments.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The activation criteria are extremely broad, including generic terms like 上传, GPT, Chat, 增强, 审核, and 知识库, which can match many unrelated requests. Over-broad triggering can route non-VOD conversations into a high-capability skill that emits shell commands for billable cloud operations, creating risk of accidental invocation, cost exposure, and unsafe command suggestions outside intended scope.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The skill description uses sweeping 'must use this Skill' language across a very broad set of topics, including VOD, image processing, semantic search, LLM chat, and AI generation, without clear boundaries or exclusions. This can cause over-triggering and routing of unrelated or only loosely related user requests into a powerful service-specific skill, increasing the chance of unintended actions, policy bypass through misrouting, and poor user control over tool selection.

Natural-Language Policy Violations

Medium

• Confidence: 75% confidence
• Finding: The skill is framed as a Tencent Cloud VOD-specific assistant and mandates use for covered requests, while also referencing specific models and platform capabilities without offering user choice of provider, locale, or alternative handling. In contexts where user language, region, or provider preference matters, this hardwiring can improperly force a specific service path and reduce compliance with locale or user-choice expectations.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The document encourages use of remote `--file-url` inputs and `--session-context` passthrough data but does not clearly disclose that these values will be sent to Tencent Cloud VOD/AIGC APIs and potentially to third-party model providers behind those services. Users may unknowingly submit sensitive URLs, internal resources, or personal/context data to external processing systems, creating privacy and data-handling risk even if the feature is functioning as designed.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation exposes `--output-storage-mode Permanent` and `--procedure` auto-processing without prominently warning that generated media can be retained indefinitely and automatically passed into downstream workflows. This increases the chance of unintended long-term retention, expanded data exposure, and surprising follow-on processing of potentially sensitive generated or referenced content.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The document states that successful creations are automatically appended to local mem/elements.json, including user-supplied fields such as element descriptions, image/video URLs, session identifiers, and session_context, but it does not warn that this data will be persistently stored. Because session_context is explicitly intended to carry user request information, the design can unintentionally retain sensitive prompts, identifiers, or internal URLs on disk, creating a privacy and data-retention risk for operators using the skill.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly states that verbose and JSON modes may reveal output URLs and full API response data, but it provides no warning about sensitivity, audience restrictions, or safe handling. In a VOD/AIGC task context, those URLs and metadata can expose media assets, review results, internal identifiers, or temporary access links that may be copied into logs, chat history, CI output, or shared terminals.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation instructs users to import media into a cloud knowledge base using a template that performs audio summarization and ASR, but it does not warn that media content and embedded speech will be transmitted for server-side processing. This can cause unintentional disclosure of sensitive audio/video data, especially when users process private or regulated content under the assumption that the action is a routine metadata operation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation explicitly supports processing external image URLs and passing through user request context, but it does not warn that these inputs may be transmitted to Tencent Cloud or downstream models/services. This can cause unintentional disclosure of sensitive image content, internal URLs, or personal/request metadata, especially because users may treat `--session-context` and `--url` as harmless operational parameters.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation encourages pulling media from arbitrary URLs and optionally triggering follow-on processing workflows, but it does not warn users that this causes external content ingestion, potential transfer of private or copyrighted material, and execution of downstream actions. In an agent setting, omission of these side-effect disclosures can lead to unintended data handling or processing of attacker-controlled URLs, making the operation riskier than a normal read-only command.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The natural-language mapping rule explicitly says to convert broad user phrasing directly into executable search parameters and '不要追问' (do not ask follow-up questions). In a VOD skill that can enumerate media assets across apps and filters, this increases the chance of unintended data retrieval, overbroad searches, or actions taken on ambiguous user intent without confirmation.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: After token creation, the script automatically writes a long-lived token to local env files without an explicit pre-action consent flow at the point of persistence. Because the token has no expiry, a single accidental write can create durable secret exposure on disk and in developer workflows.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The delete command performs an irreversible remote deletion of an API token using a single parameter and no confirmation step. An accidental invocation, typo, or automation mistake could revoke a production token and disrupt dependent services.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Automatically running pip install/upgrade during import or pre-execution without user confirmation is unsafe because imports are expected to be low-risk and side-effect minimal. This behavior can surprise operators, alter shared environments, and trigger package installation code execution merely by using dependent scripts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script silently writes AIGC custom element output to local storage without explicit user consent or a prominent warning. Hidden persistence can expose sensitive prompts, derived metadata, or identifiers to other local users, backups, or later processes, violating least surprise and secure-by-default behavior.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script sends media for cloud AI analysis and may persist derived summaries/transcripts into a knowledge base, but the CLI flow provides no explicit privacy or data-handling warning at execution time. In a media-analysis tool, this can cause users to upload sensitive audio/video content without fully understanding that content and derived data will be processed and stored remotely.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script submits user-supplied image content and prompts to Tencent VOD/LLM services via ProcessImageAsync, but provides no explicit privacy warning, consent gate, or data-handling notice before sending FileId/URL/Base64-backed image data to a remote service. In this skill context, the risk is elevated because the command specifically targets image understanding with LLMs, which can encourage users to process sensitive images without realizing they are being transmitted to third-party cloud services.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.