Volcengine AI MediaKit

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:27 AM UTC
• Version: 1.0.5

Overview

The skill mostly matches cloud media processing, but a media-info lookup can automatically publish unpublished videos to obtain playback links.

Install only if you intend to let the agent upload media to Volcengine VOD and submit processing jobs. Use scoped credentials, avoid sensitive unpublished videos unless publishing them is acceptable, and treat returned playback URLs as potentially shareable/downloadable links.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (98)

Tainted flow: 'req' from os.getenv (line 348, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/api_manage.py (reported line 349)May include surrounding context.

python

)
            try:
                req = urllib.request.Request(info_url)
                with urllib.request.urlopen(req, timeout=30) as response:
                    result_data = json.loads(response.read().decode("utf-8"))
            except urllib.error.URLError as e:
                raise Exception(f"get_video_audio_info: failed to fetch video info: {e}")

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description frames the feature set as media processing, but the workflow also performs asset ingestion from local files and remote URLs into VOD. That materially expands the trust boundary: the skill can read user-accessible local files and fetch arbitrary remote content, which may surprise users and reviewers and can be abused for unintended data transfer or SSRF-style network access depending on the uploader implementation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description frames the feature set as media processing, but the workflow also performs asset ingestion from local files and remote URLs into VOD. That materially expands the trust boundary: the skill can read user-accessible local files and fetch arbitrary remote content, which may surprise users and reviewers and can be abused for unintended data transfer or SSRF-style network access depending on the uploader implementation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented operation is presented as a read-only media info lookup, but it can automatically publish unpublished videos as a side effect in order to obtain an Origin playback URL. This violates least surprise and can change asset visibility/state without explicit user consent, potentially exposing private or not-yet-approved media.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/api_manage.py (reported line 51)May include surrounding context.

python

# 按优先级逐级尝试加载 .env（override=False：系统环境变量更优先）
for base in [os.getcwd(), os.path.dirname(os.path.abspath(__file__))]:
    env_path = os.path.join(base, ".env")
    if os.path.isfile(env_path):
        load_dotenv(env_path, override=False)
        log(f"已加载 .env：{env_path}")

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The play-info lookup path implicitly calls update_media_publish_status when content is not already published, meaning a read-style request can mutate remote state and make content accessible. This is particularly dangerous because callers asking only for metadata or a link may unknowingly trigger publication of previously private media.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_transport.py (reported line 107)May include surrounding context.

python

if ak and sk:
        return ak, sk
    bail("未找到 AK/SK。请设置环境变量 VOLCENGINE_ACCESS_KEY_ID / VOLCENGINE_ACCESS_KEY_SECRET，或放置 .env 文件。")

def get_vod_transport_client() -> Union[SkillhubApigVodClient, VolcRequestClient]:
    if resolve_vod_transport() == "apig":

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest and module docstring describe this skill as providing 人声/伴奏分离, but the code constructs a task of type "AudioExtract" with {"Voice": True}, which indicates extracting an audio track or voice channel rather than separating vocals from accompaniment into distinct outputs. This is a direct mismatch between the claimed capability and the implemented media operation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises and orchestrates capabilities that require environment-variable access, file reads, and network operations, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where a host agent may grant broader runtime powers than reviewers or users expect, increasing the risk of unintended file access, credential use, or outbound requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs operators to provide access keys and secret keys but gives no warning about credential sensitivity, storage, rotation, or non-disclosure. In a skill that performs networked media operations and optional .env loading, poor credential-handling guidance increases the chance of secrets being placed in unsafe locations, exposed in logs, or shared back to users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation explicitly permits using arbitrary public HTTPS URLs as media inputs, which can cause the skill runtime to fetch attacker-controlled remote content. In an audio/video processing skill, this expands the trust boundary and can expose users to privacy leakage, unintended network access, and potential SSRF-like behavior or ingestion of malicious media if URL handling is not tightly constrained.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file’s natural-language instructions, parameter descriptions, and example annotations are entirely in Chinese. Under the policy, forcing a specific language without user opt-in or a documented justification is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file’s natural-language instructions, parameter descriptions, and examples are all presented in Chinese, which can impose a language constraint on users without opt-in. Under the policy, language restrictions should either offer a choice or be clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

A language or locale policy violation applies to all file types when a skill forces a specific language without user opt-in. This file presents all natural-language instructions in Chinese and does not indicate that Chinese is optional, selectable, or required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language content and usage instructions are presented only in Chinese, which can impose a language requirement on users without explicit opt-in. Under the policy rule, forcing a specific language is a reportable issue unless the skill offers a language choice or clearly documents a justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file’s natural-language instructions, parameter descriptions, and examples are presented only in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file’s user-facing instructions and descriptions are presented only in Chinese, which imposes a specific language on users without indicating any option to choose another language. This matches the language/locale policy violation criteria for natural-language policy issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. The natural-language documentation forces a specific language for usage instructions without indicating user opt-in or that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file presents all user-facing instructions and parameter descriptions exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the regional constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instructions explicitly tell the agent to return a directly playable/downloadable public URL for the processed video without any warning about access scope, retention, or whether the URL is publicly accessible beyond the intended user. In a media-processing skill, outputs may contain sensitive or copyrighted content, so exposing a raw public link can lead to unintended sharing or data leakage if the link is logged, forwarded, or accessed by unauthorized parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The parameter IsEraseSubtitle explicitly enables removal of original subtitles from the video, which is a content-altering operation affecting output integrity. The markdown documents the switch but does not warn users that this changes the original visible content and may be irreversible in the generated result.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation explicitly states that unpublished videos may be automatically published to get playback URLs, but does not warn users that invoking a query-style operation can modify media state. In an agent setting, this increases the risk of unauthorized publication because operators may believe they are performing a harmless lookup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends user-supplied video and subtitle content to an external client method via submit_vcreative, which is a network-style operation transmitting potentially sensitive user data. In this file there is no confirmation prompt, print/log disclosure, or comment/docstring warning that the media and subtitle inputs will be submitted externally.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest presents the skill as processing media, querying task status, and returning playback links or media information. However, when retrieving playback info, the code may call UpdateMediaPublishStatus to publish an unpublished asset before returning a URL, which changes remote media state rather than only querying it.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill implements media upload from public URLs and arbitrary local files, but the manifest describes processing/query capabilities and does not clearly disclose file-ingestion behavior. Hidden upload capability expands the trust boundary: user data or local files may be transmitted to an external VOD service without operators expecting that behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.