叙事手绘故事视频

• Outcome: Review
• Latest audit: Aug 26, 2026 · 7:09 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed video-production workflow whose command use, local file access, model download, and media rendering steps fit its stated purpose, though its optional Python ML dependencies should be installed cautiously.

Install this only in a project/virtualenv you control, use npm ci for the renderer, ensure torch resolves to a patched current version, keep Qwen model IDs or model_path values trusted, and retain BGM attribution as the skill requires.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to read environment variables, access local files, and execute shell commands, but it does not declare permissions or scope limits for those capabilities. That creates a real least-privilege and transparency problem: an agent may perform filesystem or shell actions the user did not explicitly approve, increasing the chance of unintended file access, command misuse, or abuse if downstream inputs are adversarial.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

qwen-tts>=0.1.1
torch>=2.5
soundfile>=0.12
huggingface-hub>=0.25

• Confidence: 92% confidence
• Finding: The dependency is specified with only a lower bound, so future installs may resolve to different versions, including newly introduced vulnerable or incompatible releases. This weakens build reproducibility and increases supply-chain risk over time, especially for a skill that depends on external model and audio tooling.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

qwen-tts>=0.1.1
torch>=2.5
soundfile>=0.12
huggingface-hub>=0.25

• Confidence: 98% confidence
• Finding: The torch dependency is unpinned and therefore may resolve to any newer release satisfying the range, which can introduce vulnerable builds or behavior changes without review. In this case the risk is amplified because the same file also maps this requirement to a version with known critical advisories, making version control especially important.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

qwen-tts>=0.1.1
torch>=2.5
soundfile>=0.12
huggingface-hub>=0.25

• Confidence: 88% confidence
• Finding: Using soundfile with only a minimum version allows nondeterministic dependency resolution and can pull in future releases with undiscovered vulnerabilities or breaking changes. While not inherently exploitable by itself, it is a real supply-chain hardening weakness.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

qwen-tts>=0.1.1
torch>=2.5
soundfile>=0.12
huggingface-hub>=0.25

• Confidence: 90% confidence
• Finding: huggingface-hub interacts with remote model distribution infrastructure, so leaving it unpinned increases exposure to supply-chain changes and unexpected security regressions. In a media-generation skill that may download models or assets, dependency drift makes the environment less predictable and more dangerous.

Known Vulnerable Dependency: torch==2.5 — 10 advisory(ies): CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution); CVE-2025-3730 (PyTorch Improper Resource Shutdown or Release vulnerability) +7 more

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The analysis indicates torch 2.5 is associated with multiple published advisories, including potential remote code execution and denial-of-service conditions. In this skill's context, PyTorch is likely used for TTS/model loading, so vulnerable deserialization or model-handling paths could be reachable if untrusted model files, weights, or crafted inputs are introduced.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: renderer/scripts/story-to-video.mjs:264