Security audit

Weryai Video Generator

Security checks for vulnerabilities and agentic risk

Overview

This WeryAI video skill is disclosed as a paid API integration, but its real runtime logic is delegated to unaudited files outside the package, so installation deserves manual review.

Install only if you trust the surrounding runtime that provides the external core/weryai-core and core/weryai-video modules. Treat WERYAI_API_KEY as a paid credential, avoid endpoint overrides unless you fully control the host, and prefer a package that vendors or pins the runtime implementation before using it for production or sensitive media.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: scripts/lib/wait.js:1
Finding: Security-Critical Runtime Logic Is Loaded from Unpinned Modules Outside the Project Boundary
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/lib/cli.js:31
Finding: Unrestricted API Endpoint Overrides Can Redirect Credential-Bearing Requests
Content: View full analysis
= 0 ? pollTimeoutEnv : 600_000, pollTimeoutOverrideMs: Number.isFinite(pollTimeoutEnv) && pollTimeoutEnv >= 0 ? pollTimeoutEnv : null, shortTaskTimeoutMs: Number.isFinite(shortTimeoutEnv) && shortTimeoutEnv >= 0 ? shortTimeoutEnv : DEFAULT_SHORT_TASK_TIMEOUT_MS, longTaskTimeoutMs: Number.isFinite(longTimeoutEnv) && longTimeoutEnv >= 0 ? longTimeoutEnv : DEFAULT_LONG_TASK_TIMEOUT_MS, }; } ``` The related documentation provides guidance but no enforced control: ```md Optional overrides `WERYAI_BASE_URL` and `WERYAI_MODELS_BASE_URL` default to `https://api.weryai.com` and `https://api-growth-agent.weryai.com`. Only override them with trusted hosts. ``` ### Technical Analysis `WERYAI_BASE_URL` and `WERYAI_MODELS_BASE_URL` are accepted directly from the environment without URL parsing, HTTPS enforcement, hostname allowlisting, port restrictions, or explicit approval. These endpoint values are ...[truncated 1954 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This code chunk does not implement text-to-video, image-to-video, storyboard-to-video, first/last-frame transitions, polling for final video output, status checks, model switching, or dry-run payload previews. Instead, it is a command-line wrapper for checking remaining WeryAI video balance. That is a materially different primary purpose and an undeclared capability relative to the description, so this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The supplied code chunk does not implement any of the declared video-related functionality. Instead, it imports executeBalance from a balance module and exports it as the skill's execute function. This suggests the skill's actual purpose is to perform a balance-related operation, which is materially different from the declared purpose of text/image/storyboard-based video generation and status handling. Therefore, the description does not accurately represent the code behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a full video-generation and transformation capability set. However, the supplied code chunk is limited to a single export statement that re-exports error utilities from a shared core module. This is materially different from the declared primary purpose and does not demonstrate the advertised behaviors. While this file could be a supporting utility within a larger skill, based on the supplied code chunk alone, the description does not accurately represent what this code actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This code chunk is a thin barrel export that forwards exports from a core normalization module. Based only on the supplied code, the observable purpose is exposing shared normalization functionality, not implementing the declared WeryAI video features. Because the declared description centers on end-user video creation and related orchestration capabilities, while the actual snippet contains only a generic re-export with no visible video-specific logic, the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description focuses on video creation and transformation workflows. However, the code chunk only exposes a command-line script whose stated help text is to list WeryAI video models and capabilities, with an optional mode filter. That is a materially different primary purpose from generating videos or managing video generation jobs. Therefore the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code accesses a sensitive credential via process.env.WERYAI_API_KEY, but the file provides no confirmation, logging, comment, or docstring disclosing that credential material is being consumed. For code files, accessing sensitive environment variables can warrant a warning when there is no visible disclosure and the behavior is not otherwise explained here.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.