WaveSpeedAI Veo 3.1 Fast Video Generation

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:02 AM UTC
• Version: 2.0.1

Overview

This video-generation skill is purpose-aligned, but it relies on unpinned WaveSpeed npm tooling and sends selected prompts or media to a remote service.

Install only if you are comfortable using WaveSpeed's remote service, storing WaveSpeed credentials via its CLI, and sending selected prompts or media files to that service. Prefer pinned reviewed package versions for the CLI or MCP server, run them as a normal user, and confirm cost and destination paths before generating or downloading outputs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Third-Party Packages Are Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–25
Vulnerability Type: Unpinned npm dependencies and automatic execution of remotely retrieved packages
Risk Level: Medium

Vulnerable Code

bash

npm install -g @wavespeed/cli

bash

npx -y @wavespeed/mcp

Technical Analysis

The documented setup commands install or execute third-party npm packages without pinning them to reviewed versions, using a lockfile, or verifying package integrity.

npm install -g @wavespeed/cli resolves the current package release and installs it globally. npm installation can execute package lifecycle scripts under the privileges of the invoking user. A global installation also makes the package broadly available in the user's environment.

npx -y @wavespeed/mcp is more direct: it resolves a package dynamically, suppresses the installation confirmation with -y, downloads it when necessary, and executes its entry point. Consequently, the code that runs can differ from the code that was available when this Skill was audited.

This is a supply-chain weakness rather than evidence that the named packages are currently malicious. Exploitation would require compromise of the package, its publisher account, its dependency chain, or the package-resolution infrastructure.

Attack Path

1. An attacker compromises the npm publisher account, package distribution process, or dependency chain associated with one of the referenced packages.
2. The attacker publishes a malicious release that becomes the version selected by npm's default resolution behavior.
3. A user follows the Skill instructions and runs either the unpinned global installation or the automatic npx -y command.
4. npm downloads the attacker-controlled release.
5. Malicious lifecycle scripts or package entry-point code execute with the privileges of the user running the command.
6. The payload can access resources available to that user, p ...[truncated 653 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to a specifically reviewed version, for example:

   bash

   npm install -g @wavespeed/cli@<reviewed-version>
   npx --yes @wavespeed/mcp@<reviewed-version>
   

2. Prefer a project-local installation governed by a committed lockfile instead of a global installation:

   bash

   npm install --save-exact @wavespeed/cli@<reviewed-version>
   npm ci
   

3. Commit and review package-lock.json, and use npm ci in automated environments to enforce deterministic dependency resolution.
4. Verify package provenance, publisher identity, signatures or attestations where available, and registry integrity metadata before installation.
5. Avoid npx -y for security-sensitive workflows. Install an approved version first, review the resolved dependency tree, and then execute the local binary.
6. Run third-party tooling as a non-administrative user in a restricted environment with access only to the files required for the task.
7. Keep authentication material outside the package working directory and limit the permissions and lifetime of API credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Setup

Install the open-source CLI once and sign in; the CLI stores the key, so never ask the user to paste an API key into the chat:

bash

npm install -g @wavespeed/cli

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill recommends running npx -y @wavespeed/mcp without pinning a specific version, which causes execution of whatever package version is current at invocation time. This creates supply-chain risk: a compromised, malicious, or breaking upstream release could be fetched and executed in the user's environment without review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill explains that @path uploads local files and substitutes a hosted URL, but it does not present this as a clear user-facing warning at the point of use. Users may unintentionally transmit sensitive local images or frames to a remote third-party service, creating confidentiality and privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The example showing --download "./out/{index}.{ext}" writes generated files to local disk without an accompanying warning. While lower risk than remote upload, silent file creation can surprise users, overwrite expected locations, or store sensitive/generated content locally where persistence was not intended.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.