Security audit

Byted Mediakit Voiceover Editing

Security checks for vulnerabilities and agentic risk

Overview

This video-editing skill mostly matches its stated purpose, but its local review server can expose readable local files and lets unauthenticated requests change or export projects.

Review before installing. Use local mode or tightly scoped cloud credentials, bind review/export servers only to 127.0.0.1, do not expose them to other hosts, avoid opening untrusted pages while the review server is running, and prefer an isolated environment because local dependency/model setup can execute third-party code.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:5
Finding: Agent Workflow and Output Hijacking Through Mandatory Skill Instructions
Content: View full analysis
/scripts` 4. 每个 CHECKPOINT 必须验证产物后再继续 5. 任何步骤失败必须**立即停止并报告**，不得继续 6. Step 4/5/6 输出**禁止**简化版、占位符、示例或省略内容 7. **最终输出必须保持原样，不能做任何修改** 8. 审核页是否自动打开由 `TALKING_VIDEO_AUTO_EDIT_REVIEW_AUTO_OPEN` 决定（**强制**）：Agent 不得额外执行 `open`/`start`/`xdg-open` 等命令 9. **超时设置**：音视频处理时长较长，宿主超时时间应设置为 **60 分钟** ``` ### Technical Analysis The Skill declares that it must be invoked for a broad range of generic video and audio requests. It then imposes a “STRICT — NO EXCEPTIONS” workflow and directs the host Agent to preserve the final output without modification. Operational instructions may document the expected sequence for a tool, but they must not attempt to override the Agent's task selection, safety constraints, response control, or higher-priority instructions. The immutable-output requirement is particularly unsafe because it can prevent the Agent from filtering inaccurate, unsafe, or externally controlled output. The trigger scope also exceeds the minimum necessary scope. Generic requests such as “process audio” or an uploaded media file do not necessarily require this specific cloud-capable editing workflow. ### ...[truncated 1044 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/serve_review_page.py:343
Finding: Arbitrary Local File Disclosure Through the Review Server
Content: View full analysis
""" raw = unquote(req_path[len("/local-media"):]) if not raw.startswith("/"): self.send_error(400, "路径必须为绝对路径") return file_path = Path(raw) if not file_path.is_file(): self.send_error(404, f"文件不存在: {raw}") return content_type, _ = mimetypes.guess_type(str(file_path)) if not content_type: content_type = "application/octet-stream" file_size = file_path.stat().st_size range_header = self.headers.get("Range") if range_header: try: range_spec = range_header.strip().replace("bytes=", "") start_str, end_str = range_spec.split("-", 1) start = int(start_str) if start_str else 0 end = int(end_str) if end_str else file_size - 1 end = min(end, file_size - 1) length = end - start + 1 self.send_response(206) self.send_header("Content-Type", content_type) self.send_header("Content-Range", f"bytes {start}-{end}/{file_size}") self.send_header("Content-Length", str(length)) self.send_header("Accept-Ranges", "bytes") self.send_header("Access-Control-Allow-Origin", "*") self.end_headers() with open(file_path, "rb") as f: f.seek(start) remaining = length while remaining > 0: chunk = f.read(min(65536, remaining)) if not chunk: break self.wfile.write(chunk) remaining -= len(chunk) except Exception: self.send_error(416, "Range Not Satisfiable") els ...[truncated 2495 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/serve_review_page.py:110
Finding: Unauthenticated Review Modification and Export APIs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/asr_volc.py:48
Finding: Configurable API Endpoints Can Receive Credentials Over Arbitrary or Plaintext Destinations
Content: View full analysis
"VolcAsrConfig": _load_skill_env() return VolcAsrConfig( api_key=_require_env("ASR_API_KEY"), base_url=_require_env("ASR_BASE_URL").rstrip("/"), ) def _http_post_json(url: str, headers: Dict[str, str], payload: Dict[str, Any], timeout_s: int) -> Dict[str, Any]: resp = requests.post(url, headers=headers, json=payload, timeout=timeout_s) resp.raise_for_status() return resp.json() def submit_bigmodel_task( audio_url: str, *, audio_type: str = "mp3", request_id: Optional[str] = None, config: Optional[VolcAsrConfig] = None, timeout_s: int = 60, ) -> str: cfg = config or VolcAsrConfig.from_env() rid = request_id or str(uuid.uuid4()) submit_url = f"{cfg.base_url}/submit?api_key={cfg.api_key}" payload: Dict[str, Any] = { "audio": {"url": audio_url, "type": audio_type}, "request": { "modal_name": "bigmodel", "enable_emotion_detection": True, "enable_gender_detection": True, "enable_speaker_info": True, "enable_poi_fc": False, "use_itn": True, "use_punc": True, "enable_ddc": True, }, "user": {"uid": "byted-mediakit-voiceover-editing"}, } headers = { "Accept": "*/*", "x-api-key": cfg.api_key, "x-api-request-id": rid, "x-api-resource-id": "volc.seedasr.auc", "Connection": "keep-alive", "Content-Type": "application/json", } data = _http_post_json(submit_url, headers, payload, timeout_s=timeout_s) ``` ```python def q ...[truncated 3234 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/pipeline_url_to_asr.py:144
Finding: Automatic Runtime Installation of Unhashed Third-Party Dependencies
Content: View full analysis
None: """检查 local 模式依赖是否已安装，未安装则自动安装 requirements-local.txt。使用标记文件 + requirements-local.txt 时间戳比对跳过已安装的情况。""" scripts_dir = Path(__file__).resolve().parent req_file = scripts_dir / "requirements-local.txt" venv_dir = scripts_dir / ".venv" marker = venv_dir / ".deps_local_installed" if venv_dir.is_dir() else scripts_dir / ".deps_local_installed" if marker.exists(): if not req_file.exists() or marker.stat().st_mtime >= req_file.stat().st_mtime: print("[local] 本地依赖已安装，跳过") return probe_packages = [ ("imageio_ffmpeg", "imageio-ffmpeg"), ("demucs", "demucs"), ("soundfile", "soundfile"), ("torch", "torch"), ("numpy", "numpy"), ] missing = [] for mod_name, pip_name in probe_packages: try: __import__(mod_name) except ImportError: missing.append(pip_name) if not missing: marker.parent.mkdir(parents=True, exist_ok=True) marker.touch() return print(f"[local] 检测到缺少依赖: {', '.join(missing)}") if req_file.exists(): print("[local] 自动安装 requirements-local.txt ...") import subprocess as _sp _sp.check_call( [sys.executable, "-m", "pip", "install", "-r", str(req_file)], stdout=sys.stdout, stderr=sys.stderr, ) else: import subprocess as _sp print(f"[local] 安装缺少的包: {' '.join(missing)} ...") _sp.check_call( [sys.executable, "-m", "pip", "install"] + missing, stdout=sys.stdout, stderr=sys.stderr, ) marker.parent.mkdir(parents=True, exist_ok=True) marker.touch() print("[local] 依赖安装完成") ``` ...[truncated 2105 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (134)

Tainted flow: 'req' from os.getenv (line 322, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/api_manage.py (reported line 323)May include surrounding context.
python
) try: req = urllib.request.Request(info_url) with urllib.request.urlopen(req, timeout=30) as response: result_data = json.loads(response.read().decode("utf-8")) except urllib.error.URLError as e: raise Exception(f"get_video_audio_info: failed to fetch video info: {e}")

Known Vulnerable Dependency: torch==2.9.1 — 4 advisory(ies): CVE-2025-3001 (PyTorch is vulnerable to memory corruption through its torch.lstm_cell function); CVE-2025-3000 (PyTorch is vulnerable to memory corruption through its torch.jit.script function); CVE-2026-4538 (A vulnerability was identified in PyTorch 2.10.0. The affected element is an unk) +1 more

Critical

Category: Supply Chain
Confidence: 92% confidence
Finding: The file pins PyTorch to version 2.9.1, and the static analysis indicates this version is affected by multiple published advisories, including memory-corruption issues in model/script execution paths. In this skill, the package is used for local audio/ASR processing on user-supplied media, which increases risk because malformed or adversarial inputs could potentially reach vulnerable native code and lead to crashes or code execution in the agent environment.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The declared description focuses narrowly on a talking-head video editing workflow, including review UI and iterative refinement, and suggests mandatory invocation for talking-head editing scenarios. The supplied code chunk is much broader and more infrastructural: it mainly wraps Volcano Engine VOD/OpenAPI operations for upload, storage/domain inspection, URL generation, task execution, and retrieval of results. While some functions do support editing-related operations such as clipping, stitching, audio processing, and subtitle handling, the code also exposes many additional capabilities not implied by the description, including green screen matting, portrait retouching, OCR, ASR, subtitle removal, enhancement, super-resolution, interlacing, and hybrid uploads. Additionally, the promised review UI/iterative refinement aspects are not represented in this chunk. So the description does not accurately represent the actual behavior of this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a full talking-head video editing skill with media ingestion, audio/video processing, automatic editing, export, and review capabilities. The supplied code chunk does none of those things. It is a configuration utility that determines execution mode, loads and validates environment variables, persists mode settings to .env, and handles missing credentials with fallback or termination behavior. While environment setup could be a supporting part of a larger editing system, this chunk’s actual behavior is narrowly focused on runtime mode/config management and does not substantiate the declared end-user editing functionality. Therefore the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The supplied code chunk is narrowly focused on local audio transcription. It loads a Silero VAD model, segments speech, transcribes audio segments with Qwen3-ASR, generates timestamped utterance/word output, and saves JSON. This is related only loosely to the declared description's 'audio processing' aspect, but it does not implement the primary claimed purpose of a one-stop talking-head video editing skill. There is no code for cutting talking-head video, removing pauses or slips, exporting edited video, handling a review UI, or managing an iterative editing workflow. The declared triggers are about editing, while this code is an ASR component. Therefore the description materially overstates and misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a comprehensive talking-head video editing skill with triggers for video cutting, removing pauses/verbal slips, audio processing, export, and review. The supplied code chunk instead implements only one specific audio-processing function: local vocal/background separation via Demucs, producing two MP3 files. While 'audio processing' is loosely related, the primary purpose is materially narrower and different from the declared end-to-end talking-head editing workflow. The code does not implement the key advertised editing capabilities or UI/export workflow for talking-head videos, so the description does not accurately represent this code chunk's actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broad end-to-end talking-head editing skill, including audio processing, automatic cuts, removal of pauses/verbal slips, export, and review/refinement workflow. The supplied code chunk does something much narrower and different: it converts subtitle segments into an ASS subtitle file and burns those subtitles into a video. While subtitle burn-in may be a supporting media operation, this chunk does not implement the core declared behaviors such as editing cuts, talking-head trimming, audio processing, or review UI. The code's primary purpose is subtitle rendering/hard-subbing, which is materially different from the declared main purpose. Resource usage (temporary files, file read/write, likely ffmpeg invocation) is broadly consistent with declared permissions, so the mismatch is primarily about functionality and triggers rather than permissions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full end-user talking-head video editing skill, but the supplied code only merges word-level ASR metadata from one JSON file into another. It does not edit video, remove pauses, process audio, export media, provide a UI, or implement a one-stop workflow. The code uses local file read/write only and a path-sanitized output directory; although the declared permissions include network and temp storage, over-declared permissions alone are not the issue. The main mismatch is that the actual primary purpose is an internal ASR transcript post-processing helper, not a talking-head video editing skill matching the listed triggers.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents this skill as a one-stop talking-head video editing system, including cutting spoken video, removing pauses/mistakes, exporting edited output, and supporting review/refinement. The supplied code chunk only implements an ingestion and preprocessing pipeline: it accepts a source, optionally uploads it, extracts audio, performs voice/background separation, denoises audio, and runs ASR transcription. Its outputs are JSON artifacts and audio/transcript intermediates, not edited videos. While some audio-processing steps are related to media preparation, the primary purpose is materially narrower and different from the declared end-to-end editing workflow. Additionally, in local mode it auto-installs dependencies with pip, which is a capability not reflected in the declared permissions, though the main mismatch is the missing editing/export/UI behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises an end-to-end talking-head video editing skill focused on editing operations such as cutting speech, removing pauses/verbal slips, audio processing, export, and review. The supplied code chunk does none of that. It is a storage/upload utility for sending a local file to Volcano Engine VOD/TOS via direct PUT, multipart upload, or VPC presigned URLs, with retries, checksum generation, and host failover. Network and file access are consistent with the declared permissions, but the core behavior is materially different from the declared purpose. This is therefore a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description is about a user-facing talking-head video editing workflow: setup, media management, audio processing, cutting pauses/verbal slips, export, and review. The supplied code does not perform any media or audio/video editing operations, nor does it implement UI, cutting logic, export composition, or iterative refinement. Instead, it is an infrastructure/helper module for selecting and executing authenticated network requests to Volcano VOD services. Network access is declared, so that permission itself is not the issue; the mismatch is that the code’s primary purpose is transport/authentication plumbing rather than the declared editing functionality. This is a material description-to-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description says this skill provides a one-stop talking-head video editing workflow, including editing operations like removing pauses and verbal slips, audio processing, exporting video, and review/refinement UI. However, the supplied code chunk does not implement any editing, media processing, or UI behavior. It only provides low-level infrastructure for making authenticated requests to Volcano Engine APIs. While such a client could support a larger media-editing system, this specific code's actual behavior is materially different from the declared primary purpose. The declared network permission is consistent with the code, but the code shown lacks the core advertised capabilities, so this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly says it MUST be invoked for a wide range of common video/audio-editing requests, which increases the chance of automatic invocation on unintended prompts. In a skill with network, file read/write, and temp storage permissions, overly broad activation materially increases the attack surface and can cause unnecessary access to user media, local files, or cloud-backed processing paths.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The listed trigger phrases are short and generic, making accidental routing likely for benign or unrelated conversations about editing. Given the skill's elevated permissions and ability to process uploaded media, this can result in unintended file/network operations and privacy exposure even without malicious intent.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The code reads environment variables and loads a local .env file, but the skill manifest does not declare any environment/config access capability. This creates a permission-model mismatch: the skill can consume secrets or sensitive configuration outside the user-visible permission set.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The file spawns another Python process via subprocess.run, but the manifest does not declare any shell/subprocess-style capability. In an agent-skill environment, this expands execution power beyond what reviewers or policy enforcement may expect, which can weaken containment and make later abuse more impactful.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.
md
# Step 1 环境检查与依赖安装（与 SKILL.md 一致）： # - 若不存在 .env：从 templates/env.md 复制生成骨架文件（不写入任何云厂商密钥）。 # - 校验必填变量：优先读**当前进程环境**（与容器注入一致），否则读 `.env`（与 python load_dotenv override=False 一致）。 # - 不执行「自动化填入密钥」；用户须在本地编辑 .env 或通过宿主/容器注入环境变量。 # # - SCRIPT_DIR: 当前脚本所在目录（.../<SKILL_DIR>/scripts） # - 默认产物目录：<工程根>/output/（见 scripts/project_paths.py：get_project_root）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.
md
# Step 1 环境检查与依赖安装（与 SKILL.md 一致）： # - 若不存在 .env：从 templates/env.md 复制生成骨架文件（不写入任何云厂商密钥）。 # - 校验必填变量：优先读**当前进程环境**（与容器注入一致），否则读 `.env`（与 python load_dotenv override=False 一致）。 # - 不执行「自动化填入密钥」；用户须在本地编辑 .env 或通过宿主/容器注入环境变量。 # # - SCRIPT_DIR: 当前脚本所在目录（.../<SKILL_DIR>/scripts） # - 默认产物目录：<工程根>/output/（见 scripts/project_paths.py：get_project_root）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/执行步骤/1. 环境检查.md (reported line 36)May include surrounding context.
md
# Step 1 环境检查与依赖安装（与 SKILL.md 一致）： # - 若不存在 .env：从 templates/env.md 复制生成骨架文件（不写入任何云厂商密钥）。 # - 校验必填变量：优先读**当前进程环境**（与容器注入一致），否则读 `.env`（与 python load_dotenv override=False 一致）。 # - 不执行「自动化填入密钥」；用户须在本地编辑 .env 或通过宿主/容器注入环境变量。 # # - SCRIPT_DIR: 当前脚本所在目录（.../<SKILL_DIR>/scripts） # - 默认产物目录：<工程根>/output/（见 scripts/project_paths.py：get_project_root）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/执行步骤/1. 环境检查.md (reported line 37)May include surrounding context.
md
# Step 1 环境检查与依赖安装（与 SKILL.md 一致）： # - 若不存在 .env：从 templates/env.md 复制生成骨架文件（不写入任何云厂商密钥）。 # - 校验必填变量：优先读**当前进程环境**（与容器注入一致），否则读 `.env`（与 python load_dotenv override=False 一致）。 # - 不执行「自动化填入密钥」；用户须在本地编辑 .env 或通过宿主/容器注入环境变量。 # # - SCRIPT_DIR: 当前脚本所在目录（.../<SKILL_DIR>/scripts） # - 默认产物目录：<工程根>/output/（见 scripts/project_paths.py：get_project_root）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/执行步骤/1. 环境检查.md (reported line 42)May include surrounding context.
md
# Step 1 环境检查与依赖安装（与 SKILL.md 一致）： # - 若不存在 .env：从 templates/env.md 复制生成骨架文件（不写入任何云厂商密钥）。 # - 校验必填变量：优先读**当前进程环境**（与容器注入一致），否则读 `.env`（与 python load_dotenv override=False 一致）。 # - 不执行「自动化填入密钥」；用户须在本地编辑 .env 或通过宿主/容器注入环境变量。 # # - SCRIPT_DIR: 当前脚本所在目录（.../<SKILL_DIR>/scripts） # - 默认产物目录：<工程根>/output/（见 scripts/project_paths.py：get_project_root）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/apply_review_to_export.py (reported line 16)May include surrounding context.
python
# Step 1 环境检查与依赖安装（与 SKILL.md 一致）： # - 若不存在 .env：从 templates/env.md 复制生成骨架文件（不写入任何云厂商密钥）。 # - 校验必填变量：优先读**当前进程环境**（与容器注入一致），否则读 `.env`（与 python load_dotenv override=False 一致）。 # - 不执行「自动化填入密钥」；用户须在本地编辑 .env 或通过宿主/容器注入环境变量。 # # - SCRIPT_DIR: 当前脚本所在目录（.../<SKILL_DIR>/scripts） # - 默认产物目录：<工程根>/output/（见 scripts/project_paths.py：get_project_root）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/execution_mode.py (reported line 9)May include surrounding context.
python
# Step 1 环境检查与依赖安装（与 SKILL.md 一致）： # - 若不存在 .env：从 templates/env.md 复制生成骨架文件（不写入任何云厂商密钥）。 # - 校验必填变量：优先读**当前进程环境**（与容器注入一致），否则读 `.env`（与 python load_dotenv override=False 一致）。 # - 不执行「自动化填入密钥」；用户须在本地编辑 .env 或通过宿主/容器注入环境变量。 # # - SCRIPT_DIR: 当前脚本所在目录（.../<SKILL_DIR>/scripts） # - 默认产物目录：<工程根>/output/（见 scripts/project_paths.py：get_project_root）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/execution_mode.py (reported line 14)May include surrounding context.
python
# Step 1 环境检查与依赖安装（与 SKILL.md 一致）： # - 若不存在 .env：从 templates/env.md 复制生成骨架文件（不写入任何云厂商密钥）。 # - 校验必填变量：优先读**当前进程环境**（与容器注入一致），否则读 `.env`（与 python load_dotenv override=False 一致）。 # - 不执行「自动化填入密钥」；用户须在本地编辑 .env 或通过宿主/容器注入环境变量。 # # - SCRIPT_DIR: 当前脚本所在目录（.../<SKILL_DIR>/scripts） # - 默认产物目录：<工程根>/output/（见 scripts/project_paths.py：get_project_root）

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/execution_mode.py (reported line 35)May include surrounding context.
python
# Step 1 环境检查与依赖安装（与 SKILL.md 一致）： # - 若不存在 .env：从 templates/env.md 复制生成骨架文件（不写入任何云厂商密钥）。 # - 校验必填变量：优先读**当前进程环境**（与容器注入一致），否则读 `.env`（与 python load_dotenv override=False 一致）。 # - 不执行「自动化填入密钥」；用户须在本地编辑 .env 或通过宿主/容器注入环境变量。 # # - SCRIPT_DIR: 当前脚本所在目录（.../<SKILL_DIR>/scripts） # - 默认产物目录：<工程根>/output/（见 scripts/project_paths.py：get_project_root）

Static analysis

No suspicious patterns detected.