WaveSpeedAI Infinitetalk Talking Avatar Video Generation

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:07 AM UTC
• Version: 2.0.1

Overview

This skill is a coherent WaveSpeed AI video-generation helper, with disclosed uploads, authentication, and usage costs, but users should be cautious about its unpinned npm CLI and MCP setup.

Before installing, consider pinning the WaveSpeed CLI and MCP package versions, using a least-privileged environment, and only uploading portraits/audio you are comfortable sending to WaveSpeed. Do not paste API keys into chat; use the CLI login or an environment variable as documented.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Packages Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–24
Vulnerability Type: Supply-chain exposure through unpinned npm dependencies
Risk Level: Medium

Vulnerable Code

bash

npm install -g @wavespeed/cli
wavespeed login          # opens https://wavespeed.ai/accesskey and stores the key
wavespeed status         # confirms you are signed in

markdown

Prefer MCP tools over shell commands? The same platform is exposed by [`@wavespeed/mcp`](https://github.com/WaveSpeedAI/mcp-server) (`npx -y @wavespeed/mcp`; tools `search_models`, `get_model_schema`, `get_price`, `upload_file`, `run_model`, `get_prediction`). It shares the CLI's stored login.

Technical Analysis

The setup instructions install @wavespeed/cli globally without an exact version and execute @wavespeed/mcp through npx -y without a version or integrity pin. Consequently, the package content executed by users can change after this Skill has been reviewed.

npm installation can execute package lifecycle scripts, while npx -y can automatically download and run the currently resolved registry version without an interactive confirmation. The repository contains no pinned dependency manifest, lockfile, integrity hash, or vendored implementation that would make the executed code reproducible or auditable.

This is a supply-chain weakness rather than evidence that the current WaveSpeed packages are malicious. Exploitation requires compromise of the relevant package, publisher account, registry resolution, or a future package release.

Attack Path

1. An attacker compromises the npm publisher account, package distribution channel, or a future release of one of the referenced packages.
2. The attacker publishes a modified package containing malicious lifecycle or runtime code.
3. A user follows SKILL.md and runs either the unpinned global installation or npx -y @wavespeed/mcp.
4. npm resolves the attacker-controlled r ...[truncated 1012 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to an exact, reviewed version, for example @wavespeed/cli@X.Y.Z and @wavespeed/mcp@X.Y.Z.
2. Replace npx -y execution with a project-local, version-pinned installation controlled by a committed lockfile.
3. Verify package provenance, signatures, publisher identity, and npm integrity metadata before approving upgrades.
4. Prefer a reproducible installation process such as npm ci with a committed lockfile rather than resolving the latest package at execution time.
5. Avoid global installation where practical and execute the dependency under a dedicated, least-privileged user or isolated environment.
6. Review lifecycle scripts and package contents before upgrades. Disable installation scripts when compatible with the package's documented operation.
7. Document an explicit dependency-update review process so version changes trigger a new security audit.
8. Restrict the runtime's access to unrelated files and environment variables, and protect stored API credentials with narrowly scoped permissions and regular rotation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Setup

Install the open-source CLI once and sign in; the CLI stores the key, so never ask the user to paste an API key into the chat:

bash

npm install -g @wavespeed/cli

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to launch an MCP server with npx -y @wavespeed/mcp without pinning a specific version or integrity-checked artifact. This creates a supply-chain risk: a compromised latest release or dependency could be fetched and executed at runtime, which is especially risky because MCP servers often receive sensitive prompts, files, and tool access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The parameter description says 'English recommended to avoid noisy results,' which steers users toward a specific language. Under the policy, language constraints should either be optional/opt-in or clearly justified as a documented locale limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This line gives a blanket instruction to use English prompts to avoid noisy or unexpected results. That is a natural-language locale preference presented as default behavior rather than a user-selected option or a narrowly justified regional constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.