动态漫画制作

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:14 AM UTC
• Version: 0.1.0

Overview

This skill appears intended for motion-comic production, but it should be reviewed because its helper scripts can write outside the chosen output folder and its online TTS path may send private script text to a third party.

Install only if you are comfortable with a media-production skill that uses local shell tools and an online TTS service. Avoid feeding it confidential scripts unless you accept that TTS text may leave your machine, and do not run the helper scripts on manifests from untrusted sources until path validation and no-overwrite safeguards are added.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/synthesize_edge_tts.py:42

Finding

Manifest-Controlled IDs Allow Path Traversal and Arbitrary File Access

Content

View full analysis

Remediation

View remediation

Path: base = base.resolve() candidate = (base / filename).resolve() if not candidate.is_relative_to(base): raise ValueError(f"Path escapes output directory: {filename!r}") return candidate ``` For Python versions without `Path.is_relative_to`, use `candidate.relative_to(base)` inside a `try` block. 3. Apply the same validation independently in both `synthesize_edge_tts.py` and `build_timeline.py`. Do not rely on the manifest having previously passed through another script. 4. Reject: - Absolute paths. - `.` and `..` path components. - Directory separators. - Empty IDs. - Control characters and platform-specific separator variants. 5. Where overwriting is not explicitly required, avoid unconditional FFmpeg `-y` behavior or require an explicit overwrite option. 6. Add regression tests using IDs such as `../target`, `/tmp/target`, `a/b`, empty strings, Unicode separators, and valid values such as `line_01`. ]]>

T08 · Insecure Dependencies

Note

• Location: README.md:97

Finding

Unpinned Third-Party Dependency Installation Creates Supply-Chain Exposure

Content

View full analysis

Remediation

View remediation

``` 2. Publish a dependency file and install from it: ```bash python3 -m pip install -r requirements.txt ``` 3. Generate and verify cryptographic hashes for direct and transitive dependencies. Use pip’s hash enforcement where practical: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Use a lock-generation tool such as `pip-tools`, and review dependency changes before updating the lock file. 5. Recommend installation inside an isolated virtual environment rather than the user’s global Python environment. 6. Add an update process that includes: - Reviewing upstream release notes. - Scanning dependencies for known vulnerabilities. - Running script-level regression tests. - Updating pins and hashes through a reviewed repository change. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README states that the current version '重点支持普通话' (primarily supports Mandarin), and later reinforces Chinese/Mandarin defaults for TTS and workflow. Under the policy, forcing a specific language or locale without explicit user opt-in is a natural-language policy concern unless the locale constraint is clearly justified as region-specific; here it is presented as a product default rather than an opt-in choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to generate TTS through Edge TTS, an online service, but the operational steps do not prominently warn that script/dialogue content will be transmitted off-machine. In this skill context, users may process unpublished stories, private scripts, or sensitive dialogue, so missing disclosure can lead to unintended data sharing with a third-party service.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill explicitly instructs the agent to read reference files, run shell scripts, invoke Python and FFmpeg, and create project/output folders, which implies file_read, file_write, and shell capabilities without declaring a restrictive tool scope. That increases the chance of overbroad tool access or unintended command execution if the skill is invoked in an environment with sensitive files or permissive shell access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file instructs the agent to 'Use Edge TTS for Chinese production voice by default,' which imposes a language/locale choice absent explicit user selection. This is a natural-language policy concern because it defaults users into a specific language rather than offering a choice or clearly limiting the skill to a Chinese-only context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction says to apply the default production brief when the user says “开始”“直接做” or otherwise authorizes an autonomous first pass. These trigger phrases are very broad, common utterances that can occur in many contexts, and the file does not provide exclusion conditions or tighter scope for when they should activate this skill behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The display name, short description, and default prompt are all written in Chinese, which imposes a specific language/locale in the skill's natural-language interface. The file does not indicate that Chinese is optional, user-selected, or required for a documented region-specific purpose.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/build_timeline.py (reported line 9)May include surrounding context.

python

def probe_duration(path: Path) -> float:
    result = subprocess.run(
        [
            "ffprobe", "-v", "error",
            "-show_entries", "format=duration",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/build_timeline.py (reported line 32)May include surrounding context.

python

def make_silence(path: Path, duration: float) -> None:
    subprocess.run(
        [
            "ffmpeg", "-hide_banner", "-loglevel", "error", "-y",
            "-f", "lavfi", "-i", "anullsrc=r=48000:cl=mono",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script creates and overwrites multiple files under a caller-supplied output directory, and ffmpeg is run with -y to force overwrite. In an agent or automated skill context, this can destroy existing files or clobber artifacts unexpectedly if the output path is misconfigured, attacker-controlled, or points at sensitive locations.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 83% confidence

Finding

The script generates an ffmpeg concat manifest from potentially user-influenced file paths and then invokes ffmpeg with -safe 0, which disables path safety checks. While this is not shell injection, it can enable processing of arbitrary files or unexpected absolute paths if an attacker can influence inputs or output location, increasing file exposure and misuse risk in an automation environment.

Content

Scanner excerpt · scripts/build_timeline.py (reported line 128)May include surrounding context.

python

)
    concat_file = out / "voice-concat.txt"
    concat_file.write_text(concat_text, encoding="utf-8")
    subprocess.run(
        [
            "ffmpeg", "-hide_banner", "-loglevel", "error", "-y",
            "-f", "concat", "-safe", "0", "-i", str(concat_file),

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/synthesize_edge_tts.py (reported line 13)May include surrounding context.

python

def run(command: list[str]) -> None:
    subprocess.run(command, check=True)


def main() -> int:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script sends line['text'] to the external edge-tts service, which can disclose sensitive script contents, prompts, or personal data contained in the manifest to a third party. In this skill context, users may process unpublished story material or other private content, and the code provides no warning, consent gate, or documented privacy boundary before transmission.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The voice value zh-CN-XiaoxiaoNeural fixes the output to a specific language/locale in the template. There is no nearby natural-language note indicating that the locale is optional, user-selectable, or justified as region-specific, which can conflict with language/locale choice policies.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Line L13 instructs authors not to end with the specific Chinese phrase “未完待续”. This imposes a language-specific constraint in natural-language guidance without user opt-in or a documented locale-specific justification, which can conflict with organizational language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.