Byted Byteplus Vod Video Enhancement

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:02 AM UTC
• Version: 1.1.0

Overview

The skill mostly matches its BytePlus VOD upload and enhancement purpose, but it needs review because configuration can redirect signed requests and selected media uploads, and one helper can publish media as a side effect.

Review this before installing in environments with real BytePlus credentials or sensitive media. Use it only from a trusted working directory, verify any .env file, avoid setting VOD_HOST except to an approved BytePlus/Volcengine endpoint, and understand that selected media and metadata are sent to BytePlus VOD. Be aware that fetching playback information may publish the remote asset.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/vod_client.py:45

Finding

Configurable API Host Can Redirect Signed Requests and Media Uploads

Content

View full analysis

dict: body_str = json.dumps(body, ensure_ascii=False) url, headers = self._sign("POST", action, version, {}, body_str) r = requests.post(url, headers=headers, data=body_str.encode(), timeout=_HTTP_TIMEOUT) self._check(r) return r.json() def get(self, action: str, version: str, params: dict) -> dict: url, headers = self._sign("GET", action, version, params or {}, "") r = requests.get(url, headers=headers, timeout=_HTTP_TIMEOUT) ``` ```python # scripts/vod_client.py:108-111, 144-150 canonical_query = urlencode(sorted(qp.items()), quote_via=quote, safe="-_.~") url = f"https://{_VOD_HOST}/?{canonical_query}" # ... headers["Authorization"] = ( f"HMAC-SHA256 Credential={self._ak}/{credential_scope}, " f"SignedHeaders={signed_headers_str}, Signature={signature}" ) return url, headers ``` ```python # scripts/tos_upload.py:308-338 ua = data.get("UploadAddress") or {} stores = ua.get("StoreInfos") or [] hosts = ua.get("UploadHosts") or [] if not stores or not hosts: raise RuntimeError("ApplyUploadInfo: UploadAddress missing StoreInfos or UploadHosts") ...[truncated 3359 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/pyproject.toml:6

Finding

Dependencies Are Not Reproducibly Pinned

Content

View full analysis

=2.31.0", "python-dotenv>=1.0.0", ] ``` ### Technical Analysis The project declares only lower bounds for `requests` and `python-dotenv`, and the audited directory contains no dependency lockfile or hash-pinned requirements file. The documented `uv run` workflow may therefore resolve and install versions different from those reviewed during the audit. The package names are legitimate and there is no evidence of typosquatting, dependency confusion, or a currently malicious release. The weakness is that installation is not reproducible: a future compromised, malicious, or incompatible release satisfying the lower-bound constraints could be selected automatically. These dependencies execute in the same Python process as the skill and can access its environment, including `BYTEPLUS_ACCESSKEY` and `BYTEPLUS_SECRETKEY`, as well as media files opened by the scripts. ### Attack Path 1. A future dependency release satisfying `requests>=2.31.0` or `python-dotenv>=1.0.0` becomes malicious or is compromised upstream. 2. A user runs the documented `uv run` command in an environment without a previously verified lockfile. 3. The resolver selects and installs the compromised version. 4. The dependency executes when imported by `vod_client.py` or `tos_upload.py`. 5. Malicious dependency code could read process credentials, inspect media files, alter network requests, or execute code with the invoking user's privileges. This path depends on an upstream package compromise or unsafe future release; no such malicious package is present in the audited artifact. ### Impact Assessment A compromised dependency would execute with the privileges of the user running the skill. It could potentially access: - BytePlus access and secret ...[truncated 390 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (16)

Tainted flow: 'url' from os.environ.get (line 111, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/vod_client.py (reported line 96)May include surrounding context.

python

def post(self, action: str, version: str, body: dict) -> dict:
        body_str = json.dumps(body, ensure_ascii=False)
        url, headers = self._sign("POST", action, version, {}, body_str)
        r = requests.post(url, headers=headers, data=body_str.encode(), timeout=_HTTP_TIMEOUT)
        self._check(r)
        return r.json()

Tainted flow: 'url' from os.environ.get (line 111, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/vod_client.py (reported line 102)May include surrounding context.

python

def get(self, action: str, version: str, params: dict) -> dict:
        url, headers = self._sign("GET", action, version, params or {}, "")
        r = requests.get(url, headers=headers, timeout=_HTTP_TIMEOUT)
        self._check(r)
        return r.json()

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description combines two major capabilities: media ingestion/upload and quality restoration. This code chunk matches the quality restoration portion well: it validates enhancement parameters, builds an Enhance/Moe task, submits it with StartExecution, polls status with GetExecution, and returns resulting playback URL information for the enhanced output. However, none of the upload-related functionality described is present in this file. There are no calls or logic for ApplyUploadInfo, TOS upload, CommitUploadInfo, UploadMediaByUrl, or any local/remote media ingestion flow. Because the declared description prominently claims upload/media-ingestion behavior that this supplied code chunk does not actually perform, the description does not accurately represent this code chunk's behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code accurately matches the upload-related portion of the description: it supports local file upload using ApplyUploadInfo → TOS upload → CommitUploadInfo, and URL pull upload using UploadMediaByUrl plus QueryUploadTaskInfo polling, then returns Vid and playback-related fields. However, the declared description also claims support for AI-based comprehensive quality restoration on uploaded videos, including denoising, compression artifact removal, scratch removal, and clarity enhancement. No such restoration or enhancement logic appears anywhere in the supplied code chunk. Therefore the description overstates the skill’s capabilities in a material way, making it a mismatch.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_client.py (reported line 43)May include surrounding context.

python

import requests
from dotenv import load_dotenv

# ── .env loading ───────────────────────────────────────────────────────────
# Look for .env in the current working directory first, then in the script's
# own directory (so the skill still works when invoked from elsewhere).
_SCRIPT_DIR = Path(__file__).resolve().parent

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_client.py (reported line 44)May include surrounding context.

python

import requests
from dotenv import load_dotenv

# ── .env loading ───────────────────────────────────────────────────────────
# Look for .env in the current working directory first, then in the script's
# own directory (so the skill still works when invoked from elsewhere).
_SCRIPT_DIR = Path(__file__).resolve().parent

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vod_client.py (reported line 48)May include surrounding context.

python

# own directory (so the skill still works when invoked from elsewhere).
_SCRIPT_DIR = Path(__file__).resolve().parent
for _base in (Path.cwd(), _SCRIPT_DIR):
    _env = _base / ".env"
    if _env.is_file():
        load_dotenv(_env, override=False)
        break

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill documents access to environment secrets, local files, and network operations, but it does not declare any explicit tool scope or permissions boundary. That creates an authorization and review gap: a host may permit broader capability use than users expect, especially since the skill handles secrets and uploads user media to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to upload local files or provide public media URLs to BytePlus VOD, but it does not explicitly warn that the media, associated metadata, and possibly derived playback URLs will be transmitted to a third-party service. This can lead to inadvertent disclosure of sensitive or regulated content if users assume processing is local or do not understand the external data flow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The playback helper performs a state-changing action by publishing the media asset before retrieving playback info. That exceeds a helper's apparent read-only role and can unintentionally expose private or draft media, especially in an automation context where callers may only expect URL lookup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Retrieving a play URL by Vid implicitly updates the remote asset's publish state, which can make previously non-public content accessible. Because this side effect is not obvious from the helper name, callers may trigger exposure of media without informed consent or proper authorization review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The project description is written only in Chinese ('将媒资从公网 URL 上传到火山引擎 VOD') with no indication that alternative languages are supported. This can violate a language/locale policy when a skill is expected to be accessible without forcing a specific language unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

The dependency on requests is only lower-bounded (>=2.31.0), so builds may resolve to versions with known security advisories depending on environment, lockfile absence, or future dependency resolution. In a skill that uploads media from public URLs and likely performs outbound HTTP requests, an unsafe requests version can be more relevant because malformed or attacker-controlled URLs may be processed during ingestion workflows.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 74% confidence

Finding

The dependency on python-dotenv is not pinned to a specific safe version, so installations may pick releases affected by known advisories. While this manifest alone does not prove the vulnerable API paths are used, dotenv libraries often interact with local files and environment handling, so unresolved version selection creates avoidable supply-chain and local file handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This code automatically loads a .env file from the working directory or script directory and later reads access credentials from environment variables. While the docstring mentions which variables are used, there is no runtime warning, prompt, or explicit user-facing disclosure that local credential material will be consumed for authenticated API operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The client issues HTTP GET/POST requests to the VOD service, and later functions send values such as space name, file name, file size, vid, and publish status to remote endpoints. Although network transport is central to the module's purpose, this file itself does not present a user-facing warning or disclosure about transmitting those inputs to an external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.