Security audit

Byted Mediakit Editing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent MediaKit CLI guide for audio and video editing, with expected cloud/media/credential risks that users should handle carefully.

Install only if you are comfortable using the Volcengine MediaKit CLI and sending media inputs to its selected local or cloud processing mode. Prefer local mode for private media when supported, avoid sensitive/internal/signed URLs unless intended, pin or verify the CLI package where possible, and do not paste real API keys directly into commands that may be saved in shell history.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: reference/shared.md:11
Finding: Unpinned Global Installation of a Third-Party CLI Package
Content: View full analysis
Remediation: View remediation
``` 2. Document the expected npm registry and reject installation from untrusted registry overrides. 3. Verify the package tarball against a publisher-provided integrity value or cryptographic signature before installation. 4. Prefer a project-local dependency with a committed lockfile instead of a global installation. 5. Perform dependency and provenance checks whenever the pinned version is upgraded. 6. Avoid running npm with administrative privileges. If global installation is necessary, use a user-owned installation prefix. 7. Consider executing the CLI in a restricted environment with only the filesystem and network access required for media processing. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: reference/shared.md:62
Finding: API Key Exposure Through Process Arguments and Shell History
Content: View full analysis
--runtime --surface cli --yes mediakit-cli init --mode local-first --api-key --endpoint --output-path ~/mediakit-output --runtime --surface cli --credential-store config --yes ``` ### Technical Analysis The non-interactive initialization examples instruct users to substitute an API key directly into a command-line argument. A real credential supplied this way may be stored in shell history and can be visible in process listings while the initialization command is running. It may also be captured by terminal logging, command auditing, diagnostic tooling, or automation logs. The second command requests configuration-file credential storage. The audited repository contains documentation only and does not include the CLI implementation, so the file permissions, encryption behavior, and secret-redaction guarantees of that storage mechanism cannot be verified from this project. No hardcoded real credential was found in the repository. Exploitation requires a user or automation system to follow the example using an actual API key. ### Attack Path 1. A user replaces `` with a valid MediaKit API key and runs one of the documented initialization commands. 2. The shell records the command in its history, or the operating system exposes the active process arguments. 3. A local attacker, another process operating under a sufficiently privileged account, or a logging system retrieves the command line. 4. The attacker extracts the API key. 5. The attacker uses the credential against the configured MediaKit endpoint until it is revoked or expires. ### Impact Assessment The attacker could perform operations authorized by the exposed MediaKit API key, potentially ...[truncated 524 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (24)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation description says the skill should trigger whenever the user needs MediaKit CLI editing capabilities, but it does not define concrete boundaries, exclusions, or disambiguation criteria. In a shell-permitted skill, this broad trigger can cause the agent to invoke the skill in unintended contexts, increasing the chance of unnecessary shell access and processing of untrusted URLs or media inputs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file presents the skill name, description, parameters, and usage only in Chinese, which can effectively force a specific language experience on users. Under the policy, language constraints should either offer user choice or be clearly justified as locale-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file presents all user-facing instructions and descriptions exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which it is not here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file documents behavior that can send user-provided video URLs and callback data to a local/cloud service, but it does not warn users that media references and callback parameters may be transmitted or processed remotely. For markdown files, omission of warnings about behavior affecting user data or privacy is in scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation instructs users to provide a video URL for local or cloud processing but does not warn that the referenced media may be fetched by external infrastructure or handled over the network. For media workflows, this can expose sensitive content, internal URLs, or credential-bearing links and may cause users to unintentionally transmit private data to third-party services.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: SQP-3 applies to all file types and includes language or locale policy violations. The entire skill file forces Chinese-language instructions and parameter descriptions, with no indication that users can opt into another language or that the skill is intentionally restricted to a Chinese-speaking context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documentation describes processing a user-supplied video_url in local/cloud modes but does not warn that the URL and referenced media may be transmitted to an external processing service. This can lead users to unknowingly expose sensitive internal URLs, signed links, or private media content, especially because the skill supports cloud execution and asynchronous task submission.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation instructs users to provide a remote video URL and notes support for both local and cloud execution, but it does not warn that media may be transmitted to external services or processed outside the user's device. In a media-editing skill handling potentially sensitive audio/video, this can lead to unintentional disclosure of personal, proprietary, or regulated content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation explicitly states the operation is cloud-only and requires user-supplied image URLs plus optional callback parameters, but it does not warn that these inputs are transmitted to a remote service. This can cause unintentional disclosure of sensitive media URLs, embedded tokens, or callback metadata, especially if users assume local-only processing from the broader MediaKit context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation instructs users to provide remote audio URLs and supports both local and cloud execution, but it does not warn that referenced media may be transmitted to external processing infrastructure or fetched by the service. This can cause unintentional disclosure of sensitive media, internal-only URLs, or metadata, especially when users assume 'local' avoids all network exposure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation instructs users to provide remote video and audio URLs but does not warn that these URLs will be fetched by the tool in local or cloud mode, which can expose sensitive media locations, trigger unintended outbound requests, or transmit user-provided content to external services. In a media-processing skill with shell permission and cloud support, this omission increases the risk of privacy, data-handling, and SSRF-style misuse because users may assume URLs are only references rather than network fetch targets.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/shared.md (reported line 27)May include surrounding context.
md
- 环境变量/配置文件：`MEDIAKIT_API_KEY`、`MEDIAKIT_ENDPOINT`、`MEDIAKIT_SURFACE`、`MEDIAKIT_RUNTIME` | 变量 | 必填 | 说明 | | ------------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------- | | `MEDIAKIT_API_KEY` | 云端模式必填 | API 认证 Token | | `MEDIAKIT_ENDPOINT` | 否 | API 访问点 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/shared.md (reported line 29)May include surrounding context.
md
| 变量 | 必填 | 说明 | | ------------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------- | | `MEDIAKIT_API_KEY` | 云端模式必填 | API 认证 Token | | `MEDIAKIT_ENDPOINT` | 否 | API 访问点 | | `MEDIAKIT_SURFACE` | 否 | 请求来源 Header `x-surface`；默认 `cli`，Skill 建议 `skill`，Plugin 建议 `plugin`，最终上报 `cli/skill` 或 `cli/plugin` | | `MEDIAKIT_RUNTIME` | 否 | 请求来源 Header `x-runtime`；按宿主设置为 `claude`、`arkclaw` 等，未配置时回退环境探测或 `unknown` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · reference/shared.md (reported line 30)May include surrounding context.
md
| 变量 | 必填 | 说明 | | ------------------- | ------------ | ----------------------------------------------------------------------------------------------------------------------- | | `MEDIAKIT_API_KEY` | 云端模式必填 | API 认证 Token | | `MEDIAKIT_ENDPOINT` | 否 | API 访问点 | | `MEDIAKIT_SURFACE` | 否 | 请求来源 Header `x-surface`；默认 `cli`，Skill 建议 `skill`，Plugin 建议 `plugin`，最终上报 `cli/skill` 或 `cli/plugin` | | `MEDIAKIT_RUNTIME` | 否 | 请求来源 Header `x-runtime`；按宿主设置为 `claude`、`arkclaw` 等，未配置时回退环境探测或 `unknown` |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file presents all user-facing instructions and parameter explanations only in Chinese. Under the policy rule, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire skill file is written only in Chinese and does not indicate that language selection is optional or that the skill is intended exclusively for a Chinese-language environment. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file presents the skill name, parameters, and usage instructions only in Chinese. Under the language/locale policy, forcing a specific language without user opt-in or justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file’s natural-language instructions and parameter descriptions are entirely in Chinese, which can impose a language constraint on users without any visible opt-in or explanation. Under the language/locale policy check, this is a natural-language policy concern because no alternative language option or justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language content forces a specific language presentation without indicating user opt-in or a documented region-specific requirement. The policy scope includes language or locale violations across all file types when no choice or justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: SQP-3 applies to all file types and includes language/locale policy violations. The document is entirely in Chinese and does not indicate that the language is optional, user-selected, or limited to a clearly justified region-specific context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation instructs users to provide an audio URL and explicitly supports local and cloud execution, but it does not warn that the media may be fetched by remote infrastructure or otherwise transmitted off-host. In a media-editing skill, this can cause unintentional disclosure of sensitive audio content or internal URLs, especially when users assume 'local' processing or do not understand mode selection.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The natural-language instructions and descriptions are entirely in Chinese, and the file does not offer an alternate language or indicate that the user has opted into this locale. That can violate a language/locale policy when skills are expected to avoid forcing a specific language without user choice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language instructions and descriptions are presented only in Chinese, which can amount to forcing a specific language without user opt-in. There is no indication that the skill is region-specific or that alternative language support is available.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation accepts a user-supplied remote video URL and explicitly supports both local and cloud execution, but it does not warn users that the URL and referenced media may be transmitted to the selected processing environment. This creates a transparency and privacy risk: users may unknowingly send internal, sensitive, or access-controlled media to remote infrastructure or expose signed URLs in logs and task metadata.
Content: No source excerpt is available for this finding.