Byted Las Video Inpaint

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:33 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its video inpainting purpose, but it auto-installs unverified remote SDK code and handles credentials/background polling in ways users should review before installing.

Install only if you are comfortable sending videos and metadata to Volcengine LAS/TOS and with a local SDK install. Use short-lived, least-privileged credentials supplied through a secure environment mechanism, avoid project-local plaintext key files, review the remote wheel installation path, and do not run the background poller without timeout/cancellation controls.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:30

Finding

Mandatory Agent Response Manipulation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:30-31, scripts/generate_result.md.sh:68-73
Vulnerability Type: Mandatory user-facing response injection
Risk Level: High

Relevant code (SKILL.md:30-31):

markdown

- **Key security**: If the chat interface blocks the key, instruct the user to create `env.sh` in the current directory and add `export LAS_API_KEY="..."`; the SDK will read it automatically.
- **Disclaimer**: The final response must include the prescribed Volcengine LAS billing disclaimer and pricing URL, and estimated prices must not be described as actual charges.

Relevant code (scripts/generate_result.md.sh:68-73):

bash

cat <<'EOF'

---

This method's charges are estimates and may differ from the final charges. The bill generated by Volcengine after execution shall prevail. For billing details, see [Volcengine LAS Pricing](https://www.volcengine.com/docs/6492/1544808).
EOF

Technical Analysis

The skill explicitly requires the Agent to append fixed, vendor-authored content and an external link to every final result. This instruction controls the Agent's user-facing response independently of the user's requested output format.

Billing notices can be legitimate, but enforcing verbatim third-party content and a fixed external link at the skill-instruction level creates a response-hijacking primitive. If this pattern were extended or the linked destination changed, the skill could direct users toward unwanted promotional or deceptive content.

Attack Path

1. The Agent loads SKILL.md while handling a video-inpainting request.
2. The mandatory workflow instruction becomes part of the Agent's active session context.
3. The Agent completes the requested operation.
4. The skill requires the Agent to alter the final response by inserting prescribed vendor text and an external URL.
5. The resulting response may no longer conform strictly to the user's re ...[truncated 333 chars]

Remediation

View remediation

Remediation Suggestions

• Replace mandatory verbatim response text with a neutral requirement to disclose estimated billing where relevant.
• Do not force a fixed external URL into every final response.
• Ensure system and user output-format requirements take precedence over skill-level presentation rules.
• If a pricing link is necessary, validate it against an approved-domain allowlist and present it only when the user requests billing information.
• Keep operational instructions separate from marketing, branding, and response-composition requirements.

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/env_init.sh:31

Finding

Remote Python Package Retrieved and Installed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: scripts/env_init.sh:31-41
Vulnerability Type: Mutable remote payload retrieval and execution
Risk Level: High

Complete vulnerable code segment:

bash

# 2. Retrieve the remote manifest
manifest_url="https://las-ai-cn-beijing-online.tos-cn-beijing.volces.com/operator_cards_serving/public/skills/sdk/manifest.json"
manifest=$(curl -sf "$manifest_url" || echo '{}')

# 3. Compare the SDK version and update automatically
local_ver=$(lasutil --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || echo "0.0.0")
remote_ver=$(echo "$manifest" | jq -r '.sdk_version // "unknown"')

if [ "$local_ver" = "0.0.0" ] || [ "$local_ver" != "$remote_ver" ]; then
  echo "Installing SDK update: $local_ver to $remote_ver"
  pip install --quiet --upgrade https://las-ai-cn-beijing-online.tos-cn-beijing.volces.com/operator_cards_serving/public/skills/sdk/las_sdk-0.2.0-py3-none-any.whl
fi

Technical Analysis

The initialization script downloads a Python wheel from an external URL and passes it directly to pip install. The package is not validated with an expected cryptographic hash, detached signature, or trusted lock file. HTTPS protects transport but does not establish that the retrieved wheel is the exact artifact reviewed with this skill.

The remote manifest also fails open. If retrieval fails, it becomes {}, and remote_ver becomes unknown. Unless the local version is also exactly unknown, the comparison can initiate installation even though the manifest could not be validated.

Installing a Python package is code execution: package installation behavior and subsequently imported modules execute with the privileges of the Agent process. Because the artifact at the URL can be replaced after this audit, the effective payload is mutable.

Attack Path

1. The Agent follows SKILL.md and sources scripts/env_init.sh.
2. The script retrieves an unsigned r ...[truncated 888 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the wheel to an immutable version and an expected SHA-256 hash.
• Download the artifact first, verify its hash or a trusted digital signature, and only then install it.
• Use a locked dependency file with hash enforcement, such as pip install --require-hashes.
• Fail closed when the manifest is unavailable, malformed, unsigned, or inconsistent with the pinned package.
• Do not perform automatic dependency upgrades during ordinary skill execution.
• Prefer dependencies shipped from a controlled, authenticated package repository with immutable releases and provenance attestations.
• Run installation and skill execution in a sandbox with minimal filesystem access, network access, and credentials.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/poll_background.sh:19

Finding

Project Environment File Is Executed as Shell Code

Content

View full analysis

Vulnerability Details

File Location: scripts/poll_background.sh:19-21
Vulnerability Type: Arbitrary command execution through unsafe configuration loading
Risk Level: Medium

Complete vulnerable code segment:

bash

if [ -f "${PROJECT_ROOT}/.env" ]; then
  source "${PROJECT_ROOT}/.env"
  export LAS_API_KEY LAS_REGION
fi

Technical Analysis

The source command interprets the entire .env file as shell code. A dotenv file should be treated as configuration data, but this implementation permits command substitutions, redirections, function definitions, shell control operators, and arbitrary commands.

Merely restricting the later export statement to LAS_API_KEY and LAS_REGION does not prevent execution, because malicious statements run while source evaluates the file.

Attack Path

1. An attacker or another untrusted process gains the ability to create or modify ${PROJECT_ROOT}/.env.
2. The attacker inserts a shell command, such as command substitution in a variable assignment or a standalone command.
3. A user or Agent launches scripts/poll_background.sh.
4. The script sources .env.
5. The injected shell command executes with the permissions and environment of the polling process.

Impact Assessment

Successful exploitation provides arbitrary command execution as the account running the skill. The attacker could read accessible credentials and files, alter polling results, modify output artifacts, make outbound requests, or tamper with the virtual environment. The vulnerability does not independently grant privileges beyond those already held by the process.

Remediation

View remediation

Remediation Suggestions

• Never load dotenv files with source.
• Use a dotenv parser that reads values as data without shell evaluation.
• Allowlist only the required keys, specifically LAS_API_KEY and LAS_REGION.
• Reject malformed lines, duplicate keys, command substitutions, control operators, and unexpected variable names.
• Verify ownership and restrictive permissions before reading a credential file.
• Prefer credentials supplied by a secret manager or the parent process environment.
• Run the polling process with minimal filesystem and network privileges.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:30

Finding

API Key Persistence in a Project-Local Plaintext Shell File

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:30
Vulnerability Type: Insecure plaintext credential storage guidance
Risk Level: Medium

Relevant instruction:

markdown

If the chat interface blocks the key, instruct the user to create `env.sh` in the current directory and add:

export LAS_API_KEY="..."

Technical Analysis

The skill directs users to write an API key into a plaintext shell file in the current project directory. It does not require restrictive file permissions, automatic deletion, source-control exclusion, encryption, or use of a secret manager.

Project-local files are commonly included in source-control commits, archives, backups, debugging bundles, and workspace synchronization. The instruction is also inconsistent with scripts/poll_background.sh, which reads .env rather than env.sh; this may cause users to create additional credential copies while attempting to make the workflow function.

Attack Path

1. A user follows the skill instruction and creates env.sh in the current directory.
2. The API key remains stored in plaintext after execution.
3. The file is accidentally committed, archived, synchronized, or read by another local user or process.
4. An unauthorized party obtains the key and uses the LAS API within the key's permissions.

Impact Assessment

Exposure permits unauthorized use of the LAS API under the compromised credential's scope, potentially resulting in data access, task submission, service consumption, and billing impact. The precise cloud privileges depend on the permissions associated with the API key. The finding does not show that a real key is currently committed to the project.

Remediation

View remediation

Remediation Suggestions

• Prefer process-scoped environment injection or an approved secret manager.
• Do not ask users to place long-lived credentials in project directories.
• If file-based storage is unavoidable, use one documented filename consistently and exclude it through .gitignore.
• Require file permissions of 0600 and validate ownership before use.
• Store only short-lived, least-privileged credentials where supported.
• Remove the credential file securely after the operation.
• Document immediate key rotation procedures for accidental disclosure.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/poll_background.sh:37

Finding

Background Polling Can Run Indefinitely During Persistent Errors

Content

View full analysis

Vulnerability Details

File Location: scripts/poll_background.sh:37-80
Vulnerability Type: Unbounded retry loop and resource exhaustion
Risk Level: Low

Complete vulnerable code segment:

bash

# Poll until terminal state
while true; do
  ((ATTEMPT++))

  # Dynamically adjust the polling interval
  if [ $ATTEMPT -le 5 ]; then
    SLEEP=60
  elif [ $ATTEMPT -le 10 ]; then
    SLEEP=120
  else
    SLEEP=300
  fi

  # Save the full response first, then extract status
  FULL_OUTPUT=$(lasutil poll "${OPERATOR_ID}" "${TASK_ID}")
  echo "$FULL_OUTPUT" > "${OUTPUT_DIR}/last_poll.json"

  STATUS=$(echo "$FULL_OUTPUT" | python3 -c "
import json
import sys
try:
  data = json.load(sys.stdin)
  print(data['metadata']['task_status'])
except Exception as e:
  print('ERROR')
")

  echo "$(date): Attempt $ATTEMPT, status = ${STATUS}, next poll in ${SLEEP}s" >> "${OUTPUT_DIR}/poll.log"

  if [ "$STATUS" = "COMPLETED" ] || [ "$STATUS" = "FAILED" ] || [ "$STATUS" = "TIMEOUT" ] || [ "$STATUS" = "CANCELED" ]; then
    echo "$FULL_OUTPUT" > "${OUTPUT_DIR}/result.json"
    echo "$STATUS" > "${OUTPUT_DIR}/COMPLETED"
    echo "$(date): Poll completed, final status = ${STATUS}" >> "${OUTPUT_DIR}/poll.log"
    exit 0
  fi

  sleep "$SLEEP"
done

Technical Analysis

The polling loop has no maximum number of attempts or elapsed-time limit. Invalid JSON, API failures, authentication failures, and unexpected response schemas are converted to ERROR, but ERROR is not treated as a terminal condition. Consequently, persistent failures cause the process to continue indefinitely.

Dynamic sleep intervals reduce request frequency but do not bound process lifetime. The log also grows without rotation for as long as the loop remains active.

Attack Path

1. Background polling starts for a task.
2. The LAS endpoint remains unavailable, credentials become inval ...[truncated 713 chars]

Remediation

View remediation

Remediation Suggestions

• Add configurable maximum attempts and maximum elapsed time.
• Terminate after a small number of consecutive parsing, authentication, or network errors.
• Return a nonzero exit code for polling failures and write a distinct failure marker.
• Use exponential backoff with bounded jitter and an upper interval limit.
• Validate known task states explicitly and fail safely on unknown states.
• Add log size limits or rotation.
• Support cancellation through signals and clean up temporary state on exit.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as a video inpainting utility, but its workflow also performs environment setup, virtualenv manipulation, SDK installation/update, and remote retrieval. Hidden installation/update and network behavior materially expand the attack surface because running the skill may fetch and execute code or modify the local environment without an explicit, matching declaration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a video inpainting utility, but its workflow also performs environment setup, virtualenv manipulation, SDK installation/update, and remote retrieval. Hidden installation/update and network behavior materially expand the attack surface because running the skill may fetch and execute code or modify the local environment without an explicit, matching declaration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script generates an ASR/transcription-oriented report (ASR 识别结果, transcript preview, audio duration, language, utterances) even though the skill is declared as a video inpainting/removal tool. This mismatch can mislead users and downstream automation about what operation was actually performed, causing incorrect handling of outputs, accidental disclosure of transcript data, or execution of the wrong workflow under a sensitive media-processing skill.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Using source on ${PROJECT_ROOT}/.env executes the file as shell code, not just reads credentials. If an attacker can modify that .env file or influence the project root contents, they can achieve arbitrary command execution in the context of this script while also gaining access to the exported API credentials.

Content

Scanner excerpt · scripts/poll_background.sh (reported line 19)May include surrounding context.

sh

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"

if [ -f "${PROJECT_ROOT}/.env" ]; then
  source "${PROJECT_ROOT}/.env"
  export LAS_API_KEY LAS_REGION
fi

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The credential-loading block around line 20 contributes to the same unsafe pattern: arbitrary shell execution through .env processing combined with export of authentication material. In the context of a video-processing skill that likely runs unattended/background jobs, this increases risk because compromised configuration could persistently hijack polling runs or misuse the LAS API key.

Content

Scanner excerpt · scripts/poll_background.sh (reported line 20)May include surrounding context.

sh

PROJECT_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"

if [ -f "${PROJECT_ROOT}/.env" ]; then
  source "${PROJECT_ROOT}/.env"
  export LAS_API_KEY LAS_REGION
fi

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes shell commands (source, lasutil, file upload, polling) but does not declare any tool scope or allowed-tools boundary. This creates an authorization gap where an agent may execute shell/network actions beyond what a user reasonably expects, increasing the chance of unintended command execution or data movement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says to use the skill when the user wants to 'clean up video footage by removing unwanted objects,' 'repair or restore videos by removing obstructions,' or 'remove visual artifacts,' which are broad phrases that overlap with many ordinary editing requests. The trigger scope is not narrowly bounded with explicit exclusions, so the skill could be invoked for generic video editing tasks beyond fixed-region inpainting or overlay removal.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs users to place sensitive API credentials in a local env.sh file without clear warnings about file permissions, shell history, accidental inclusion in project directories, or exposure to other tools/processes. This increases the risk of credential leakage and subsequent unauthorized access to LAS or related cloud resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow uploads local video files to a remote service/storage and does not require an explicit privacy or data-transfer warning beforehand. Users may unknowingly send sensitive or regulated video content off-device, creating confidentiality, compliance, and consent risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script fetches remote metadata and conditionally installs executable SDK code from a network-hosted wheel during environment initialization, without integrity verification, signature checking, or explicit user consent. This creates a supply-chain execution path where a compromised hosting endpoint, manifest process, or wheel artifact could lead to arbitrary code execution on the user's system whenever the init script is sourced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script silently retrieves remote manifest data and installs a package from a direct URL without disclosing this behavior in its usage text or requiring confirmation. Hidden network fetch-and-install behavior is dangerous because users sourcing an environment setup script may not expect code acquisition and execution, increasing the risk of unnoticed supply-chain compromise or policy violations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The inline usage/docs explicitly describe generating markdown for speech recognition results rather than video inpainting results, contradicting the manifest. Such contradictory labeling increases the chance that operators, users, or orchestration systems invoke the wrong service or trust incorrect output semantics, which is particularly risky in media-processing pipelines where different data types and retention rules apply.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This shell script emits all user-facing headings, errors, and billing text in Chinese, as shown in comments and echoed/generated markdown content. That creates a language/locale policy concern because the skill imposes a specific language without user opt-in or any documented region-specific justification in the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sources a project .env file and exports LAS_API_KEY and LAS_REGION, which is sensitive credential handling. Although this is functional for the script, there is no user-facing warning, confirmation, or explanatory comment indicating that credentials will be read from the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The script performs a polling call via lasutil poll and immediately saves the full response to last_poll.json, later also writing result.json. This transmits and persists remote task data, but the script does not clearly warn the user that API response contents will be stored on disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions mandate that the final reply 'must include' a specific Chinese billing statement, regardless of the user's preferred language. This is a locale/language policy issue because it imposes a fixed language without presenting an opt-in, fallback, or bilingual option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This JSON eval file contains user-facing natural-language content exclusively in Chinese across the prompt and expected_output fields. Because the file does not offer an explicit language or locale choice, it may violate a policy requiring user opt-in before forcing a specific language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file describes a remote API endpoint, requires an Authorization bearer token, and accepts a video download URL, which implies user or system data is transmitted to an external service. Under the markdown-file criteria for SQP-2, the document should warn about privacy, credential handling, or external data transfer impacts, but no such warning is present.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script's title, error messages, and status output are written in Chinese, which imposes a specific language on all users. The file does not indicate that the skill is intended only for a Chinese-speaking environment or provide any user opt-in or locale selection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Comments and runtime messages such as the usage text and status/error output are written only in Chinese. This imposes a specific language on all users without offering a locale choice or documenting that the script is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script includes user-facing text and descriptive comments in Chinese, including the usage-adjacent header and error output, without indicating that the skill is intentionally Chinese-only or offering a language choice. This can violate language/locale policy when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.