Security audit

Avatar-Outfit-Motion Video

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed media-generation workflow, but it handles face, voice, and endorsement-style content without enough upfront consent, privacy, and safe model-loading controls.

Review before installing. Use this skill only with media you own or are authorized to use, especially faces, voices, action videos, and branded products. Do not use it for impersonation or undisclosed endorsements, and only run the depth scripts with model weights from a trusted, verified source.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a high-level multimedia generation skill focused on composing avatar, clothing, action, speech, background, and product elements into videos or images. The supplied code chunk instead implements a DINOv2-based Vision Transformer model architecture: token preparation, positional embedding interpolation, transformer forward passes, intermediate layer extraction, and model size constructors. This is a generic internal computer vision backbone and does not itself perform the claimed media generation tasks. While such a model could potentially be used as a supporting component in a larger system, the code shown does not substantiate the declared primary purpose, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a high-level multimodal media-generation skill with specific end-user capabilities around virtual try-on, action transfer, digital humans, and composited video/image outputs. The actual code chunk is only an init.py file that re-exports foundational model-layer classes for a DINOv2/depth-related component. This code does not itself implement the declared pipeline, media processing features, asset composition logic, trigger handling, or output generation behavior. While such layers could be supporting infrastructure in a larger system, this specific chunk is too generic and unrelated to substantiate the claimed primary purpose, so the description does not accurately represent what this supplied code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a high-level end-user skill for generating and composing avatar, clothing, action, voice, background, and prop assets into video/static outputs. The supplied code does not implement any of those domain-specific behaviors. Instead, it is a generic neural network building block: multi-head attention and memory-efficient attention for transformer models. This could be a supporting internal component of a larger vision model, but by itself it does not match the declared purpose and has a materially different primary function.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code chunk is a generic model component: a transformer Block and NestedTensorBlock used for neural network forward passes. It handles tensor normalization, attention, MLP residuals, stochastic depth, and batching utilities. This is materially different from the declared skill purpose, which describes a full content-generation system for avatar/clothing/action composition and video/static asset output. While such a block could theoretically be part of a larger vision model stack, this snippet by itself does not implement the declared user-facing capabilities, triggers, or workflow. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a high-level AI media generation system for outfit, motion, lip-sync, background replacement, and related video/static asset workflows. The actual code chunk is a narrow, low-level neural network helper implementing stochastic depth in PyTorch. It does not perform avatar generation, clothing synthesis, motion transfer, lip-sync, background replacement, product insertion, prompt handling, media composition, or guardrail orchestration. This is not merely a supporting implementation detail that clearly maps to the declared end-user functionality; taken on its own, the code’s primary purpose is materially different and unrelated to the claimed skill behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a high-level multimedia generation and composition system for avatar/clothing/action video and image creation. The actual code chunk is only a low-level neural network utility layer used in model architectures: it initializes a learnable scaling vector and applies elementwise tensor scaling. It does not implement any of the claimed user-facing capabilities such as video generation, pose transfer, lip-sync, background replacement, or product insertion. While such a layer could be a supporting component inside a larger vision model, this isolated code chunk does not substantively represent the declared skill behavior, so the description and behavior are materially mismatched.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a high-level multimedia generation system for combining avatar, clothing, action, audio-driven lip-sync, background, and props into videos or static assets. The actual code chunk is only a generic multilayer perceptron component implemented in PyTorch. It contains no domain-specific logic for image/video generation, composition, asset management, lip-sync, background replacement, or any of the described five-domain pipeline steps. While such an MLP could be a supporting internal component somewhere in a larger ML system, this isolated code does not substantively implement or evidence the declared behavior. Therefore the description does not accurately represent what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a high-level multimodal content-generation system for creating and combining six media elements into videos or static assets. In contrast, the actual code is a narrow, internal neural-network utility: a patch embedding layer for image tensors in a vision model. It only validates image dimensions, applies a Conv2d projection, optional normalization, reshaping, and computes FLOPs. This is a materially different primary purpose and does not implement the advertised end-user functionality. While such a module could be a supporting component inside a larger vision system, the supplied chunk by itself does not align with the declared skill behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a high-level multimedia generation and composition system for creating outfit/action/avatar videos and related assets. The supplied code chunk only defines a SwiGLU-based feed-forward neural network module in PyTorch, plus an optional fused xFormers-backed variant. It contains no code for video generation, image processing, audio-driven lip sync, background manipulation, product placement, prompt handling, or pipeline orchestration. This is not merely a supporting implementation detail that clearly maps to the declared skill; it is a generic low-level model layer with a materially different primary purpose from the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description centers on generative media composition involving avatars, clothing, actions, lip-sync, backgrounds, props, and video/static asset assembly. In contrast, the supplied code is a computer vision model for estimating depth from an image. It defines neural network blocks, extracts intermediate features from DINOv2, fuses them in a DPT head, and outputs a single-channel depth map resized to the original image dimensions. There is no implementation of avatar generation, outfit transfer, action composition, lip-sync, background replacement, product insertion, or video assembly in this code chunk. Depth estimation could potentially be a supporting component in a larger media pipeline, but that role is not reflected in the declared purpose, and this chunk’s primary function is materially different from the stated skill behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises a high-level system for generating and composing avatar, clothing, action, voice, background, and props into videos or static outputs. The supplied code chunk does not implement any of those user-facing capabilities. It only defines generic PyTorch modules (Conv2d-based residual and feature fusion blocks, plus interpolation) used as internal components of a computer vision model. While such blocks could theoretically support a larger vision pipeline, this code by itself materially differs from the declared primary purpose and lacks the advertised generation/composition behaviors. Therefore this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a high-level end-user skill for generating and composing avatar, clothing, action, audio, background, and product-placement media assets into videos or images. In contrast, the provided code chunk only implements generic preprocessing transforms: resizing samples with optional aspect-ratio handling, normalizing image values, and converting image/depth/mask arrays into network-ready tensor layouts. These are supporting CV utilities and do not themselves generate avatars, clothing, actions, lip-sync, backgrounds, props, or composed media outputs. Because the actual code’s primary purpose is materially different from the declared skill behavior, this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a multi-stage media-generation system focused on avatar/clothing/action composition, lip-sync, motion transfer, background/prop generation, and final video or static asset creation. The supplied code does none of those things. Instead, it performs monocular depth inference on an input image and outputs depth visualizations. While the description briefly mentions '深度视频提取' among many trigger phrases, this specific script is not implementing the advertised six-element composition pipeline or the stated primary functions. Its primary purpose is materially different and much narrower than the declared behavior, so this is a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents a broad multimodal generation/compositing system for avatar, clothing, action, lip-sync, background, and props. The supplied code does none of that directly. Its sole function is to process an existing video into a depth-map video using a pretrained depth estimation model. While the declared triggers mention '深度视频提取' (deep/depth video extraction), this script is still only a narrow preprocessing utility and does not implement the claimed end-user functionality. Therefore the code chunk's actual behavior is materially different from the declared primary purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest includes many broad trigger phrases that cover sensitive media-manipulation use cases such as portrait-based generation, lip-sync, motion transfer, background replacement, and product insertion without clearly constraining acceptable use. In an agentic environment, overbroad triggers can cause the skill to activate in ambiguous contexts and process likeness, voice, or promotional content without appropriate consent, provenance, or policy gating.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill asks users to provide portrait images, action videos, and voice audio or scripts, but it does not present an explicit privacy, consent, and rights warning at the point of collection. Because this skill is designed for identity-linked media synthesis and manipulation, missing notice and consent checks materially increase the risk of non-consensual deepfake creation, misuse of personal data, and unauthorized commercial use of likeness or voice.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The heading and the entire task specification are written as a required Chinese-language workflow, with no indication that users may choose another language or locale. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the locale limitation is explicitly justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The template explicitly directs collection of user-supplied photos, audio, scripts, and product images as inputs to the workflow, but provides no privacy notice, consent guidance, data minimization rules, or handling restrictions. In this skill's context, those inputs can include personally identifying and biometric data (face images and voice), so omission of safeguards materially increases the risk of oversharing, unauthorized retention, or misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The sample materials list specifically asks for a clear front-facing avatar photo and audio or voice materials, which are high-risk identifiers that can enable face/voice cloning, impersonation, and other privacy harms if mishandled. Because this is a digital human / lip-sync / motion-compositing skill, the requested inputs are especially sensitive and the absence of warnings or consent checks makes the issue more dangerous, not less.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Line L033 states the output format as "英文提示词" (English prompt words), which imposes a language requirement in the skill content. Under the policy rule, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Insecure deserialization: torch.load() without weights_only=True

Medium

Category: Dangerous Code Execution
Confidence: 98% confidence
Finding: The code passes a user-controlled model path into torch.load(), which uses Python pickle semantics and can execute arbitrary code during deserialization. If an attacker can supply or replace the .pth file, running this script could lead to arbitrary code execution on the host, which is especially dangerous in an agent skill that may process externally provided assets or automation inputs.
Content: Scanner excerpt · scripts/infer_depth.py (reported line 31)May include surrounding context.
python
print('[info] device =', DEVICE) print('[info] loading model ...') model = DepthAnythingV2(**MODEL_CONFIGS[encoder]) model.load_state_dict(torch.load(model_path, map_location='cpu')) model = model.to(DEVICE).eval() print('[info] model loaded')

Insecure deserialization: torch.load() without weights_only=True

Medium

Category: Dangerous Code Execution
Confidence: 98% confidence
Finding: The code uses torch.load() on a path taken from command-line input without restricting deserialization to tensor weights. PyTorch checkpoint loading relies on Python pickle semantics, so a crafted .pth file can execute arbitrary code during load, making this a real code-execution risk if an attacker can supply or replace the model file.
Content: Scanner excerpt · scripts/video_to_depth.py (reported line 41)May include surrounding context.
python
print('[info] device =', DEVICE) print('[info] loading model ...') model = DepthAnythingV2(**MODEL_CONFIGS[encoder]) model.load_state_dict(torch.load(model_path, map_location='cpu')) model = model.to(DEVICE).eval() print('[info] model loaded')

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file contains user-facing instructions and descriptions only in Chinese, which can constitute a language/locale policy issue when no user opt-in or justification is provided. The file does not indicate that the skill is limited to Chinese-speaking users or that another language option is available.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The error message includes a hard-coded Chinese phrase ("可选") with no mechanism for the user to choose language or locale. The policy for natural-language behavior applies to all file types, and this line imposes a specific language element without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script emits user-facing status/error text containing Chinese phrases such as "可选" and "全部帧" alongside English. This imposes a specific language/locale on users without opt-in or a documented reason, which fits the natural-language policy violation criteria.
Content: No source excerpt is available for this finding.