可灵 Kling 视频生成替代｜AI 视频生成与编辑

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:20 AM UTC
• Version: 1.0.0

Overview

This is a coherent AI video-generation helper, but its helper script trusts server-supplied upload/download URLs and filenames too broadly for automatic local file and network actions.

Review before installing. Use this only with media you intend to send to AI Hive, run it in a limited workspace or virtual environment, prefer `--no-download` or a dedicated output directory for untrusted tasks, and avoid using it on sensitive networks until URL validation and output-path containment are added.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/videogen.py:232

Finding

API-Controlled Arbitrary Media Upload Destination

Content

View full analysis

Vulnerability Details

File Location: scripts/videogen.py, lines 232-243
Vulnerability Type: Unvalidated externally supplied upload URL and HTTP method
Risk Level: Medium

Vulnerable Code

python

upload_url = token["upload"]["url"]
upload_method = token["upload"].get("method", "PUT")
upload_headers = token["upload"].get("headers", {})

# PUT to object storage without the API key, using the returned headers
print(f"[2/3] Uploading file to object storage...")
with open(str(path), "rb") as f:
    try:
        oss_resp = requests.request(
            upload_method, upload_url, headers=upload_headers,
            data=f, timeout=300,
        )

Technical Analysis

The upload-token API response controls the destination URL, HTTP method, and request headers used when transmitting a user-selected local media file. The client does not validate that upload_url uses HTTPS, belongs to an approved object-storage domain, or resolves to a non-local address. It also does not restrict upload_method to an expected method such as PUT.

Consequently, a compromised AI Hive service, compromised API account, malicious upstream component, or intercepted response under a compromised trust environment could instruct the client to send the selected file to an attacker-controlled endpoint. Supplying an HTTP URL could also remove transport confidentiality.

The authorization header used for AI Hive is not attached to this request, which limits direct API-key disclosure. Nevertheless, the complete contents of the selected media file and any server-supplied upload headers are transmitted to the unvalidated destination.

Attack Path

1. The user invokes the generate or upload command with a local media file.
2. The client sends the file metadata to the fixed upload-token API.
3. A compromised or malicious upstream response returns an attacker-controlled upload.url, arbitrary upload.method, and op ...[truncated 721 chars]

Remediation

View remediation

Remediation Suggestions

• Require the upload URL to use https.
• Maintain an explicit allowlist of approved object-storage hostnames and reject all other destinations.
• Resolve and validate the destination address to reject loopback, link-local, private, and reserved network ranges where they are not explicitly required.
• Restrict the upload method to the exact methods supported by the service, normally PUT or POST.
• Validate server-supplied headers against a small allowlist and reject sensitive or unexpected headers.
• Revalidate the destination after every redirect, or disable redirects for upload requests.
• Fail closed when any URL, hostname, method, or header validation fails.
• Consider binding the expected upload host and method into a signed upload-token response that can be verified locally.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/videogen.py:268

Finding

Unvalidated Result URLs and Server-Controlled Download Paths

Content

View full analysis

Vulnerability Details

File Location: scripts/videogen.py, lines 268-280 and 351-367
Vulnerability Type: Server-side request forgery from the client environment and path traversal during result download
Risk Level: Medium

Vulnerable Code

python

resp = requests.get(url, stream=True, timeout=timeout)
resp.raise_for_status()
total = int(resp.headers.get("content-length", 0))
downloaded = 0
with open(str(out_path), "wb") as f:
    for chunk in resp.iter_content(chunk_size=8192):
        if chunk:
            f.write(chunk)
            downloaded += len(chunk)

python

out_dir = Path(output_dir)
out_dir.mkdir(parents=True, exist_ok=True)
task_type = task.get("taskType", "task")
for i, item in enumerate(succeeded):
    result_url = item.get("resultUrl")
    if not result_url:
        continue
    ext = ".mp4" if "video" in task_type.lower() else ".png"
    filename = f"{task_type}_{task_id}_{i+1}{ext}"
    out_path = out_dir / filename
    download_file(result_url, out_path)

# Last frame
for item in succeeded:
    last_frame = item.get("lastFrameUrl")
    if last_frame:
        out_path = out_dir / f"{task_type}_{task_id}_lastframe.png"
        download_file(last_frame, out_path)

Technical Analysis

The client downloads resultUrl and lastFrameUrl values supplied by the task API without validating their schemes, hostnames, resolved addresses, or redirect destinations. Because the request originates from the user's machine, a compromised upstream service could direct it to loopback services, private network systems, cloud metadata addresses, local file-sharing gateways, or attacker-controlled hosts. The response body is then written to disk.

The output filename also includes the API-controlled taskType value and the task identifier without sanitization. pathlib does not automatically guarantee that the resulting path remains inside output_dir. Di ...[truncated 1861 chars]

Remediation

View remediation

Remediation Suggestions

• Accept only https result URLs.
• Restrict result URLs to an explicit allowlist of trusted content-delivery or object-storage hostnames.
• Resolve destination addresses and reject loopback, link-local, private, multicast, and reserved ranges unless explicitly required.
• Disable redirects or revalidate the scheme, hostname, port, and resolved address after every redirect.
• Generate output filenames locally rather than incorporating server-controlled task metadata.
• If metadata must appear in filenames, replace every character outside a strict allowlist such as [A-Za-z0-9._-].
• Resolve both the output directory and candidate output path, then verify with Path.relative_to() that the candidate remains beneath the output directory.
• Open new files using exclusive creation where overwriting is unnecessary.
• Apply maximum download-size limits while streaming, rather than relying solely on Content-Length.
• Consider storing files in a newly created per-task directory with restrictive permissions.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:54

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 54
Vulnerability Type: Mutable and integrity-unverified dependency installation
Risk Level: Low

Vulnerable Code

bash

pip3 install requests

The runtime script also directly imports the dependency:

python

try:
    import requests
except ImportError:
    print("Missing dependency: requests. Run pip3 install requests", file=sys.stderr)
    sys.exit(1)

Technical Analysis

The documented installation command installs the latest package version selected by the configured Python package index. It does not pin a reviewed version, verify package hashes, or use a lock file.

The package name requests is legitimate and no typosquatting or dependency-confusion package was identified in the project. However, the installation remains mutable: future releases, a compromised package index, a compromised maintainer account, or a maliciously configured package source could change the code installed under the same command. Python package installation may execute build-system code during installation, so compromise can occur before the Skill itself runs.

Attack Path

1. A user follows the documented pip3 install requests instruction.
2. Package resolution uses the user's configured package index and selects a mutable current release.
3. The selected index, package release, maintainer account, or dependency chain is compromised.
4. The package installer downloads and installs attacker-controlled content without checking a project-approved hash.
5. Malicious build or runtime code executes with the privileges of the user performing the installation.

Impact Assessment

Successful supply-chain exploitation could execute arbitrary code with the privileges of the account running pip, access that account's files and credentials, and compromise subsequent Skill execution. The finding is rated Low because no malicious dependency is ...[truncated 109 chars]

Remediation

View remediation

Remediation Suggestions

• Pin requests and all transitive dependencies to reviewed versions.
• Store dependency pins in a lock file or a requirements file containing cryptographic hashes.
• Install dependencies with pip install --require-hashes -r requirements.txt.
• Use a trusted, explicitly configured package index rather than relying on ambient user configuration.
• Review and update dependency versions through a controlled process with vulnerability scanning.
• Prefer installation in an isolated virtual environment under an unprivileged account.
• Record supported Python and dependency versions to make installations reproducible.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill exposes operational examples that invoke shell commands, local files, environment variables, package installation, and outbound network access, but it does not declare any tool scope or permission boundaries. In an agent environment, this can lead to over-privileged execution where the agent may access files or make network requests without explicit user-visible constraints, increasing the blast radius of prompt misuse or prompt injection.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description contains broad activation phrases like general searches for Kling alternatives, video generation, editing, and API usage, which can cause the skill to trigger on a wide range of ordinary requests without clear boundaries. Over-broad routing is dangerous because it can unexpectedly steer users into a skill that performs file, shell, or network actions, even when a narrower or safer capability should have been selected.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest describes a Kling-alternative video workflow skill centered on Seedance text/image/reference video generation, editing, extension, and related media handling. While API key initialization is mentioned in the module docstring, this block also opens a browser to a chat/login page and guides the user through account login and key creation, which is ancillary account-management behavior rather than core video generation capability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.