Security audit

AI MEDIAKIT VIDEO EDIT

Security checks for vulnerabilities and agentic risk

Overview

This video-editing skill is mostly coherent, but it needs Review because its optional Remotion rendering path uses a vulnerable and unlocked npm setup.

Review before installing. Upgrade Remotion and related packages to at least 4.0.410, add and use a reviewed lockfile, avoid running npm or system installs as root unless necessary, and confirm audio normalization explicitly because the script default does not match the documentation. citeturn0search1turn0search2

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:61
Finding: Non-Reproducible npm Installation Permits Mutable Transitive Dependencies and Lifecycle Scripts
Content: View full analysis
/dev/null && echo "已安装" || echo "需要安装" ``` If not installed, execute: ```bash cd byted-ai-mediakit-videoedit/template && npm install ``` `template/package.json:8-19`: ```json "dependencies": { "@remotion/bundler": "4.0.0", "@remotion/renderer": "4.0.0", "react": "18.2.0", "react-dom": "18.2.0", "remotion": "4.0.0" }, "devDependencies": { "@remotion/cli": "4.0.0", "@types/react": "18.2.64", "@types/react-dom": "18.2.25" } ``` No `package-lock.json` or other dependency lockfile is present in the audited project. ### Technical Analysis The direct dependencies are pinned to exact versions, which reduces direct version drift. However, the absence of a committed lockfile means that `npm install` must resolve the complete transitive dependency graph at installation time. Transitive dependencies may use version ranges and can therefore resolve to artifacts that were not included in, or verified during, this audit. npm installation can also execute dependency lifecycle scripts such as `preinstall`, `install`, and `postinstall`. If a resolved package or its registry artifact is compromised, such a script can execute arbitrary code with the privileges of the user running the Skill setup. The installation is consequently not deterministic: two users installing the same audited project at different times may receive different transitive code. ### Attack Path 1. A transitive dependency permitted by the dependency graph is compromised, republished, or resolves to a newly introduced malicious version. 2. A user follows the Skill instructions because `node_modules` is absent. 3. The user runs `npm install` without a reviewed loc ...[truncated 1189 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/cut_and_merge.py:344
Finding: Audio Normalization Defaults to Enabled Contrary to the Explicit-Consent Workflow
Content: View full analysis
1: print(f"\n{'='*50}") print(f"音量均衡（EBU R128 loudnorm，目标 -16 LUFS）") norm_files = [] for i, cp in enumerate(clip_files): norm_path = os.path.join(tmpdir, f'clip_{i:03d}_norm.mp4') print(f" [{i+1}/{len(clip_files)}] {Path(cp).name}", end=' ... ', flush=True) normalize_clip_audio(cp, norm_path) norm_files.append(norm_path) print('✓') clip_files = norm_files ``` The documented requirement in `SKILL.md:253-255` states: ```text normalize_audio defaults to false, only executed after explicit user confirmation. ``` ### Technical Analysis The implementation substitutes `True` whenever the `normalize_audio` property is absent. For every job containing more than one successfully extracted clip, this activates two-pass EBU R128 processing without requiring the explicit confirmation mandated by the Skill workflow. This is a fail-open configuration pattern. An omitted property is treated as authorization to perform an optional, resource-intensive transformation rather than as a request to skip it. The processing invokes FFmpeg once to analyze loudness and again to normalize each clip. It also re-encodes audio, so the discrepancy affects both resource use and generated media. The issue does not provide command injection or elevated privileges because FFmpeg ...[truncated 1310 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (26)

Known Vulnerable Dependency: remotion==4.0.0 — 2 advisory(ies): CVE-2026-30120 (Remotion: remote code execution (RCE) vulnerability); CVE-2026-30121 (Remotion: arbitrary file write vulnerability)

Critical

Category: Supply Chain
Confidence: 97% confidence
Finding: The package pins remotion to version 4.0.0, and the finding indicates this exact version is affected by published critical advisories including remote code execution and arbitrary file write. In a video rendering template, this dependency is likely used during preview and render workflows, so a vulnerable build/render path could expose the host running the skill to code execution or filesystem compromise.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill declares it 'must be triggered' for a wide set of common phrases such as video editing, clip splicing, and highlight extraction. This can cause unintended invocation on ordinary user requests, increasing the chance the agent performs local file analysis or proposes command execution in contexts where the user did not specifically intend to use this skill.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
**Acceptance Criteria and Fixing Guidelines:** | Dependency | Minimum Requirement | Verification Method | Installation Command When Not Met | | ---------- | -------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------- | | Python | 3.9+ | `python --version` | See instructions below | | ffmpeg | Any version | `ffmpeg -version` | macOS: `brew install ffmpeg` · Linux: `sudo apt install ffmpeg` · Windows: [ffmpeg.org](https://ffmpeg.org/download.html) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
| Dependency | Minimum Requirement | Verification Method | Installation Command When Not Met | | ---------- | -------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------- | | Python | 3.9+ | `python --version` | See instructions below | | ffmpeg | Any version | `ffmpeg -version` | macOS: `brew install ffmpeg` · Linux: `sudo apt install ffmpeg` · Windows: [ffmpeg.org](https://ffmpeg.org/download.html) | | ffprobe | Included with ffmpeg | `ffprobe -version` | Installed with ffmpeg, no separate operation needed | | Node.js | 18+ | `node --version` | macOS: `brew install node` · or [nodejs.org](https://nodejs.org/) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.
md
| Dependency | Minimum Requirement | Verification Method | Installation Command When Not Met | | ---------- | -------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------- | | Python | 3.9+ | `python --version` | See instructions below | | ffmpeg | Any version | `ffmpeg -version` | macOS: `brew install ffmpeg` · Linux: `sudo apt install ffmpeg` · Windows: [ffmpeg.org](https://ffmpeg.org/download.html) | | ffprobe | Included with ffmpeg | `ffprobe -version` | Installed with ffmpeg, no separate operation needed | | Node.js | 18+ | `node --version` | macOS: `brew install node` · or [nodejs.org](https://nodejs.org/) |

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
| Dependency | Minimum Requirement | Verification Method | Installation Command When Not Met | | ---------- | -------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------- | | Python | 3.9+ | `python --version` | See instructions below | | ffmpeg | Any version | `ffmpeg -version` | macOS: `brew install ffmpeg` · Linux: `sudo apt install ffmpeg` · Windows: [ffmpeg.org](https://ffmpeg.org/download.html) | | ffprobe | Included with ffmpeg | `ffprobe -version` | Installed with ffmpeg, no separate operation needed | | Node.js | 18+ | `node --version` | macOS: `brew install node` · or [nodejs.org](https://nodejs.org/) |

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
| Dependency | Minimum Requirement | Verification Method | Installation Command When Not Met | | ---------- | -------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------- | | Python | 3.9+ | `python --version` | See instructions below | | ffmpeg | Any version | `ffmpeg -version` | macOS: `brew install ffmpeg` · Linux: `sudo apt install ffmpeg` · Windows: [ffmpeg.org](https://ffmpeg.org/download.html) | | ffprobe | Included with ffmpeg | `ffprobe -version` | Installed with ffmpeg, no separate operation needed | | Node.js | 18+ | `node --version` | macOS: `brew install node` · or [nodejs.org](https://nodejs.org/) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
Before any analysis, confirm individually whether each video has subtitles or danmaku: | Video | Has Subtitles | Has Danmaku | Understandability | | ------------ | ------------- | ----------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- | | video\_A.mp4 | ✅ | — | **Intelligent Analysis**: Can understand video based on content semantics, supports content requests like "find highlights/find appearance introduction" | | video\_B.mp4 | — | ✅ | **Intelligent Analysis** (downgraded): Infer content through danmaku, accuracy lower than subtitles |

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.
md
### Step 6: Present Editing Plan to User and Wait for Confirmation After completing analysis and transition selection, **must** present the complete plan to the user in table form, **stop and wait for user's explicit confirmation before continuing execution**. Do not call `cut_and_merge.py` without confirmation. **Plan Presentation Format:**

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The confirmation logic recognizes only Chinese approval keywords and does not provide a language-neutral or locale-aware mechanism. In non-Chinese interactions this can cause missed confirmations or misinterpretation, undermining the safety check that is supposed to prevent editing execution before clear consent.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/cut_and_merge.py (reported line 61)May include surrounding context.
python
def check_ffmpeg(): """检查 FFmpeg 是否可用。""" try: subprocess.run(['ffmpeg', '-version'], capture_output=True, check=True) return True except (subprocess.CalledProcessError, FileNotFoundError): return False

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/cut_and_merge.py (reported line 69)May include surrounding context.
python
def get_video_duration(video_path: str) -> float: """获取视频时长（秒）。""" result = subprocess.run( ['ffprobe', '-v', 'quiet', '-print_format', 'json', '-show_format', video_path], capture_output=True, text=True )

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/cut_and_merge.py (reported line 104)May include surrounding context.
python
'-avoid_negative_ts', 'make_zero', output_path ] result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print(f" [错误] FFmpeg 截取失败:\n{result.stderr[-500:]}") return False

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/cut_and_merge.py (reported line 200)May include surrounding context.
python
'-avoid_negative_ts', 'make_zero', output_path ] result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print(f" [错误] FFmpeg 截取失败:\n{result.stderr[-500:]}") return False

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/cut_and_merge.py (reported line 214)May include surrounding context.
python
'-avoid_negative_ts', 'make_zero', output_path ] result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print(f" [错误] FFmpeg 截取失败:\n{result.stderr[-500:]}") return False

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/cut_and_merge.py (reported line 255)May include surrounding context.
python
'-avoid_negative_ts', 'make_zero', output_path ] result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print(f" [错误] FFmpeg 截取失败:\n{result.stderr[-500:]}") return False

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/cut_and_merge.py (reported line 312)May include surrounding context.
python
'-avoid_negative_ts', 'make_zero', output_path ] result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print(f" [错误] FFmpeg 截取失败:\n{result.stderr[-500:]}") return False

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 80% confidence
Finding: The script writes untrusted clip paths directly into an FFmpeg concat list file using file '{cp}' without escaping embedded quotes or special concat-file syntax. A crafted filename containing a quote and newline can inject additional concat directives, causing FFmpeg to read and merge unintended local files accessible to the process.
Content: Scanner excerpt · scripts/cut_and_merge.py (reported line 126)May include surrounding context.
python
'-avoid_negative_ts', 'make_zero', output_path ] result = subprocess.run(cmd, capture_output=True, text=True) os.unlink(list_file) if result.returncode != 0: print(f" [错误] 合并失败:\n{result.stderr[-500:]}")

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/cut_and_merge.py (reported line 136)May include surrounding context.
python
def get_video_resolution(video_path: str) -> tuple[int, int]: """获取视频分辨率 (width, height)，失败返回 (0, 0)。""" result = subprocess.run( ['ffprobe', '-v', 'quiet', '-select_streams', 'v:0', '-show_entries', 'stream=width,height', '-of', 'json', video_path], capture_output=True, text=True

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/video_effects.py (reported line 175)May include surrounding context.
python
output_path, ]) subprocess.run(cmd, check=True) def main():

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Multiple defaultProps values expose user-facing strings in Chinese, such as titles, labels, and danmaku messages, but the file provides no opt-in, fallback, or explanation that the skill is intentionally Chinese-only. This creates a natural-language locale policy concern because the skill appears to force a specific language by default.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The entire skill reference is written only in Chinese and does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-language or region-specific audience. Under the policy, a forced language or locale without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code file contains natural-language documentation and runtime messages entirely in Chinese, including usage instructions and error/status output. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The error and progress messages at L113 and L116 are hard-coded in Chinese, which imposes a specific language on users of the skill. The file does not offer any language selection, opt-in, or documentation showing that the skill is intentionally limited to a Chinese-only context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The component repeatedly prioritizes Chinese-specific fonts such as "PingFang SC", "Noto Serif SC", "STHeiti", and "Heiti SC" in theme definitions and message rendering. This imposes a locale-specific presentation choice in natural-language/UI behavior without any user opt-in or documented justification, which can violate language or locale policy requirements.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.