Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent cloud media-processing tool, but it asks agents to collect and persist API secrets in a local .env file and has under-disclosed external media handling.
Review before installing. Use platform-managed secrets or process-scoped environment variables instead of letting an agent write real AMK_API_KEY or ARK_API_KEY values into the repository .env file. Do not submit confidential, signed, internal, or personal media URLs unless approved for processing by Volcengine/Ark services, and rotate any credentials that may already have been stored or shared.
scripts/main.py:34API credentials may be stored in a repository-local file without restrictive permissions
This file reads environment variables (AMK_ENABLE_CLIENT_TOKEN and ARK_MODEL_ID), but the declared permissions omit environment access. In an agent-skill setting, undeclared access to runtime configuration/secrets weakens the permission model and can expose sensitive deployment metadata or enable behavior that operators did not explicitly authorize.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
script_dir = os.path.dirname(os.path.abspath(__file__))
# 项目根目录是scripts的上级目录
root_dir = os.path.dirname(script_dir)
env_path = os.path.join(root_dir, ".env")
# 1. 自动创建.env文件（不存在时）
if not os.path.exists(env_path):
The dependency list pins idna==3.11, and the supplied advisory metadata indicates this exact version is affected by CVE-2026-45409. Because this skill has network permission and includes HTTP client libraries, IDNA processing may occur when handling attacker-controlled hostnames or URLs, potentially enabling denial of service or domain-handling/security bypass issues depending on the vulnerable code path.
The skill declares that when users mention broad classes of audio/video tasks, the host agent 'must' invoke this skill. This creates an overly broad and mandatory routing rule that can override safer tool selection, increase unnecessary data transmission to external services, and cause user media URLs/prompts to be sent off-platform without sufficient contextual verification or consent.
The title "统一返回格式" and the entire document are written only in Chinese, establishing a language-specific response format with no indication that users may choose another language. The policy explicitly flags skills that force a specific language or locale without user opt-in.
The skill explicitly accepts arbitrary remote media URLs over HTTP/HTTPS but provides no warning or constraints about server-side fetching, privacy exposure, or unsafe/internal URL targets. In a network-enabled media-processing skill, this can lead to SSRF-style access to internal resources, unintended transmission of sensitive URLs to a third-party service, or processing of attacker-controlled content without user awareness.
The file presents all user-facing instructions and parameter descriptions exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified, which is not stated here.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 参数
| 参数名 | 类型 | 必填 | 说明 |
| ---------------- | ------ | ---- | ------------------------------------------------------------------------------------------------------------------------------------ |
| video_url | string | ✅ | 输入视频 URL，支持 `http://` 或 `https://` |
| tool_version | string | ❌ | 工具版本：`standard`（标准版，默认）\| `professional`（专业版） |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| 参数名 | 类型 | 必填 | 说明 |
| ---------------- | ------ | ---- | ------------------------------------------------------------------------------------------------------------------------------------ |
| video_url | string | ✅ | 输入视频 URL，支持 `http://` 或 `https://` |
| tool_version | string | ❌ | 工具版本：`standard`（标准版，默认）\| `professional`（专业版） |
| resolution | string | ❌ | 目标分辨率：`240p` \| `360p` \| `480p` \| `540p` \| `720p` \| `1080p` \| `2k` \| `4k`；未提供则使用原始分辨率（即不传 `resolution`） |
| resolution_limit | int | ❌ | 目标长宽限制，范围 [64, 2160] |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| video_url | string | ✅ | 输入视频 URL，支持 `http://` 或 `https://` |
| tool_version | string | ❌ | 工具版本：`standard`（标准版，默认）\| `professional`（专业版） |
| resolution | string | ❌ | 目标分辨率：`240p` \| `360p` \| `480p` \| `540p` \| `720p` \| `1080p` \| `2k` \| `4k`；未提供则使用原始分辨率（即不传 `resolution`） |
| resolution_limit | int | ❌ | 目标长宽限制，范围 [64, 2160] |
| fps | float | ❌ | 目标帧率，范围 (0, 120] |
## 分辨率选择策略（宿主agent）
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| tool_version | string | ❌ | 工具版本：`standard`（标准版，默认）\| `professional`（专业版） |
| resolution | string | ❌ | 目标分辨率：`240p` \| `360p` \| `480p` \| `540p` \| `720p` \| `1080p` \| `2k` \| `4k`；未提供则使用原始分辨率（即不传 `resolution`） |
| resolution_limit | int | ❌ | 目标长宽限制，范围 [64, 2160] |
| fps | float | ❌ | 目标帧率，范围 (0, 120] |
## 分辨率选择策略（宿主agent）
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
## 参数
| 参数名 | 类型 | 必填 | 说明 |
| ----------- | ----- | ---- | ------------------------------------------------------------------------------------------ |
| images | array | ✅ | 待合成图片列表；CLI 可用 `image_url=xxx,duration=3,animation_type=zoom_in`，多图空格分隔 |
| transitions | array | ❌ | 视频转场 ID 列表，同 [`concat_media_segments.md`](concat_media_segments.md) 中的转场 ID 表 |
The entire skill description is presented only in Chinese, with no indication that other languages are supported or that the user can opt into this locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly documented and justified.
The documentation requires users to provide a video URL and prompt for processing by a large model, but it does not clearly warn that both the referenced media and prompt content are transmitted to an external model service. This creates a real privacy and data-governance risk because users or host agents may send sensitive URLs, tokens embedded in URLs, or confidential prompt content without informed consent.
Functions such as trim_audio, trim_video, concat_audio, concat_video, mux_audio_video, image_to_video, extract_audio, and enhance_video construct JSON bodies from user-supplied media URLs or payloads and send them over the network. The file contains no user-facing print/log/confirmation and no warning comment or docstring disclosing that these inputs are sent to external APIs.
This code sends prompt text and a video URL to a remote API via AsyncApiRequest(...).request(json=request_payload). While the function validates inputs and documents parameters in a technical docstring, it does not provide any user-facing warning, confirmation, or explicit disclosure that user content will be transmitted to an external service.
This client sends network requests and automatically injects an Authorization header derived from API keys or bearer tokens. Although the class docstring explains the auth mechanism, there is no user-facing warning, confirmation, or visible logging at the point where credentials and request data are transmitted over the network.
The async client performs the same authenticated network transmission as the sync client, including automatically merged Authorization headers. This file does not provide a user-facing warning, confirmation, or visible runtime notice when credentials and request contents may be sent to remote services.
The error-construction logic explicitly instructs an agent to obtain a user's real secret and persist it into the repo-root .env file or shell environment. In an agentic skill with file read/write permissions, this encourages secret material to be stored in workspace files where it may be exposed through logs, subsequent tool calls, source control accidents, or other skills/processes with filesystem access.
The structured error text directs an agent to solicit the user's actual API key and then modify repo files or export it in the shell before retrying. This is dangerous because it operationalizes secret collection and persistence by the agent itself, increasing the chance of credential disclosure to the model context, local files, command history, debug output, or later unintended reads in a skill that has both network and file access.
This code file contains extensive natural-language strings such as the module docstring, model docstrings, field descriptions, and validation error messages entirely in Chinese. Under the stated policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a natural-language policy violation.
This Python file contains natural-language comments, error messages, and CLI help text in Chinese, and the parser description/help strings shown to users are also Chinese-only. Under the policy, forcing a specific language without user opt-in is a locale-policy violation unless the constraint is explicitly documented and justified, which is not present here.
The inline documentation labels the feature as '文生视频（图片转视频）', which includes 'text-to-video', but the parser only defines an --images argument and no text prompt input. This is an active contradiction between the documented intent and the implemented behavior, not merely an omitted detail.
This markdown file presents all instructions, labels, and warnings exclusively in Chinese. Under the policy, forcing a specific language without offering a user choice or documenting a justified locale constraint is a natural-language policy violation.
Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.
No suspicious patterns detected.