Security audit

Videosays · Video to Text

Security checks for vulnerabilities and agentic risk

Overview

This video-transcription skill is coherent, but it repeatedly runs the current npm latest package, including for login and API-key workflows, so users should review that supply-chain risk before installing.

Install only if you are comfortable letting the current npm release of `videosays` run locally and handle Videosays credentials, submitted links, and account actions. Prefer a pinned, reviewed CLI version or an isolated environment with limited credentials.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 97)May include surrounding context.
md
While a batch is running, `batch status` uses a lightweight status response. When the batch finishes, the CLI retrieves the complete results once. Do not replace this with per-Task polling. Every `batch <file>` submission sends a client-generated `Idempotency-Key`. Repeat an ambiguous submission with the same `--submission-id <uuid>` to receive the original server Batch ID; an equivalent active batch for the same account also converges on one Batch ID. Completed work is reused by default. Use `--force-new` only for an intentional fresh batch. Batch submission and status commands return promptly. Do not rerun the input file as a status check, do not invent a Batch ID, and do not use `batch resume`. If batch submission ends before printing a Batch ID, do not automatically submit the file with a new id: the server may already have accepted it. Retry with the same `--submission-id` if one is available; otherwise check recent tasks and report the ambiguous outcome if it cannot be recovered.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill repeatedly instructs the agent to execute npx -y videosays@latest, which fetches and runs whatever package version is current at execution time rather than a reviewed, immutable release. This creates a supply-chain risk: if the npm package is compromised, hijacked, or publishes a malicious update, the agent would execute attacker-controlled code with access to environment variables, network, and possibly cached credentials.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Using npx -y videosays@latest in authentication flows is especially risky because the executed package may handle login state and API keys. A malicious or compromised package update could intercept credentials, exfiltrate tokens, or alter authentication behavior before the user notices.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill's whoami command still executes an unpinned npm package from the registry. Even seemingly harmless commands can run arbitrary install and runtime scripts, allowing supply-chain compromise without requiring a transcription action.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The login instruction uses an unpinned package version from npm, so the trust boundary extends to the latest package publisher state at runtime. Because login flows commonly create or access long-lived session material, compromise here can have lasting downstream effects.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 99% confidence
Finding: The login --api-key example combines execution of an unpinned package with direct handling of a sensitive API key. If the latest package version is malicious or tampered with, it could read and exfiltrate the supplied key immediately.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The core transcription command executes videosays@latest, meaning user-supplied links and the configured API key are processed by code that may change at any time. This materially increases exposure because the command handles both untrusted input and credentials, making supply-chain compromise more dangerous in context.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Polling status via npx -y videosays@latest still executes unpinned remote code on every check. Repeated execution increases the attack surface and the chance of pulling in a newly compromised release during a later polling step.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The status --format timeline command resolves the latest CLI package dynamically. Although lower risk than login, it still permits arbitrary code execution from the npm supply chain during routine agent operation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Using @latest for status --format srt introduces the same supply-chain execution risk as other commands. A compromised update could tamper with returned subtitle content, misreport task state, or exfiltrate local environment data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The status --format vtt invocation dynamically downloads and runs the latest npm package, leaving output generation dependent on mutable upstream code. This can enable malicious code execution or silent output manipulation if the package is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The recovery guidance to run history via @latest continues the pattern of executing mutable, unreviewed code from npm. In an incident scenario, this can worsen impact by giving potentially malicious code another chance to access account metadata and environment state.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The batch submission command processes multiple user-provided links while sending account credentials through a CLI resolved at runtime from @latest. This raises the blast radius of a supply-chain compromise because one invocation may expose multiple inputs and operational metadata at once.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Batch status checks also use an unpinned package, so even read-like operations execute mutable code from the registry. This preserves the same arbitrary code execution risk across the full workflow.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The continuation command after insufficient credits executes @latest in a stateful workflow tied to account balances and queued jobs. A malicious package update could misuse the authenticated session, alter billing-related actions, or tamper with batch handling.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Although --wait is optional, it still relies on executing the latest package from npm. Long-running attached sessions can increase exposure if the tool behavior changes unexpectedly or performs additional unreviewed actions during waiting/polling.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The batch --wait form inherits the same mutable-package execution problem and may run for extended periods while attached to agent context. This can increase opportunity for secret exposure or behavior tampering by compromised upstream code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The balance command executes unpinned code that can access account state and local environment data. Even though it is informational, it still gives a compromised package an execution opportunity and visibility into billing/account metadata.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The history command's use of @latest continues the same supply-chain risk pattern. A compromised package could enumerate prior tasks and leak user data or operational history.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The doctor command is intended for troubleshooting, but it still executes code from the latest npm package. Diagnostic commands are not inherently safe; a malicious update could falsify results or collect network/environment details.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The batch cancel command uses an unpinned package in a state-changing operation. If the package is compromised, it could cancel the wrong jobs, trigger unauthorized API calls, or exploit the authenticated environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The connection-error recovery step tells operators to run doctor via @latest, again trusting mutable registry content during a troubleshooting scenario. This is risky because users may be more likely to run extra commands during outages, providing more chances for malicious code to execute.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.