Security audit

剪映 CapCut 视频生成替代｜AI 视频生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AI video-generation helper, but it needs Review because remote service responses can direct media upload hosts and influence local output paths without enough validation.

Install only if you are comfortable sending selected media and prompts to AI Hive and storing an API key locally. Use non-sensitive test media first, prefer `--no-download` or a dedicated output directory for untrusted tasks, and consider reviewing or patching host allowlisting and task ID filename validation before production use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/capcut_insert.py:140
Finding: API-Controlled Media Upload to Untrusted HTTPS Hosts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/capcut_insert.py:232
Finding: Server-Controlled Task Identifier Enables Output Path Traversal
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:89
Finding: Unpinned Runtime Installation of a Third-Party Dependency
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill invokes Python scripts, installs dependencies, uses environment variables, reads local files, and makes outbound network requests, but it does not declare any explicit tool scope or permissions. This creates an authorization gap where a host agent may execute broader file, shell, or network actions than a reviewer or user expects, increasing the chance of unintended data access or exfiltration if the scripts or prompts are modified or abused.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code requests upload tokens, uploads local media, and submits generation prompts to a remote API, which transmits user content off the local system. Although the tool's purpose involves generation, the code does not visibly disclose that local files and descriptive prompt content will be sent to an external service at the points where those operations occur.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script's descriptions, errors, help text, and status messages are consistently written in Chinese, with no option to select another language. This creates a language policy concern under the rule because the skill enforces one locale for all users without opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code stores the supplied API key in ~/.ai-hive/config.json and secures the file permissions, but there is no prior warning or confirmation that credentials will be persisted locally. This is a sensitive operation because it affects credential handling beyond the current session.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.