FlowCutPro

• Outcome: Review
• Latest audit: May 28, 2026 · 9:34 AM UTC
• Version: 1.0.0

Overview

FlowCutPro is a coherent video-generation skill, but it includes an embedded API key and under-discloses external provider and credential-handling risks.

Review carefully before installing. Only run it after removing the embedded key and configuring your own restricted VEO_API_KEY, and avoid confidential concepts unless you accept sending prompts and generated shot details to external AI providers. The evidence does not show malicious intent, but the credential handling and disclosure gaps are material enough for Review.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tainted flow: 'url' from os.environ.get (line 193, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

sep = "&" if "?" in uri else "?"
    url = f"{uri}{sep}key={API_KEY}"
    try:
        with urllib.request.urlopen(urllib.request.Request(url), timeout=120) as r:
            out.write_bytes(r.read())
        mb = out.stat().st_size / 1_048_576
        print(f"    ✅ {out.name} ({mb:.1f}MB)")

• Confidence: 91% confidence
• Finding: The script downloads a URL returned by the remote API and appends the API key to that URL without validating the destination host. If a compromised or unexpected response supplies an attacker-controlled URI, the key could be leaked to a third party and arbitrary content could be fetched into the workflow.

Tainted flow: 'req' from os.environ.get (line 156, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

url = f"{uri}{sep}key={API_KEY}"
    try:
        req = urllib.request.Request(url)
        with urllib.request.urlopen(req, timeout=120) as r:
            out.write_bytes(r.read())
        mb = out.stat().st_size / 1_048_576
        print(f"    ✅ {out.name} ({mb:.1f}MB)")

• Confidence: 92% confidence
• Finding: The code appends the API key to whatever URI is returned in the video-generation response and then fetches it without validating the destination host. If a compromised API response or unexpected service behavior supplies an attacker-controlled URL, the skill will leak its Google API key to that external endpoint and perform an arbitrary outbound request.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: A hardcoded Google API key is embedded directly in the example and used automatically if no environment variable is set. Embedded credentials can be abused by anyone with repository access, may incur billing or quota exhaustion, and normalize insecure secret handling in downstream copies of the code.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: A live Google API key is hardcoded directly in the skill, which exposes a reusable credential to anyone who can read the source, logs, or packaged artifact. This can enable unauthorized use of the associated cloud resources, quota exhaustion, billing impact, and secondary compromise if the key has broader permissions than intended.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill lacks a clear user-facing warning that user concepts are sent to an external Google API and that rendered media is saved locally. This omission undermines informed consent and can lead to unintended disclosure of sensitive prompts, proprietary ideas, or regulated content, especially given the skill's broad triggers.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Falling back to a built-in API key means the script silently performs authenticated outbound requests even when the operator has not explicitly configured credentials. In a skill that may be reused or redistributed, this increases accidental misuse, secret leakage, and unapproved billing exposure.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill automatically uses a credential, including a hardcoded fallback, without clear user disclosure that external paid APIs will be contacted under that credential. In a skill context, this is more dangerous because users may trigger the tool expecting local video planning but instead consume third-party quota and send authenticated requests transparently.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The user-provided concept is sent to Anthropic for shot planning and then to Google's Veo API for video generation, but the skill provides no explicit warning or consent flow about these third-party disclosures. In this skill's context, prompts may contain proprietary marketing plans, unreleased product ideas, or personal information, making silent transmission materially risky.

Static analysis

No suspicious patterns detected.