Security audit

天猫电商视频生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Tmall video-generation skill, but it needs review because it handles API credentials and downloaded files with weak scoping safeguards.

Review before installing. Use this only with a trusted AI Hive endpoint, avoid custom base URLs unless you control them, and run it in an isolated environment because it stores an API key and writes downloaded results to disk. The publisher should validate allowed API hosts and sanitize output filenames before this is treated as low risk.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/videogen.py:86
Finding: API Credential Disclosure Through an Unrestricted Custom Base URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/videogen.py:367
Finding: Arbitrary File Write Through Unsanitized Server-Controlled Task Type
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:68
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file contains substantive user-facing natural-language content entirely in Chinese across the changelog entries. Under the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill includes executable commands that invoke Python scripts, install packages, and imply use of filesystem, environment, network, and shell capabilities, yet it does not declare any tool scope or permission boundaries. This creates an avoidable trust gap: a host agent may execute the skill with broader privileges than necessary, increasing the chance of unintended file access, network egress, or command execution if the scripts or inputs are abused.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill title, description, and all operational instructions are written entirely in Chinese and direct use specifically for 天猫 content, with no indication that another language is supported or that the user can opt in to Chinese-only behavior. This is a natural-language policy concern because it imposes a specific language/locale without explicit choice or a documented justification in the file.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file implements a broad, general-purpose AI Hive client while the declared skill is narrowly scoped to Tmall video generation/editing. This creates a capability mismatch: a caller who trusts the skill metadata may unknowingly gain access to unrelated functions such as chat, image generation, model enumeration, account info lookup, and arbitrary media upload. In a skill ecosystem, hidden or unnecessary capabilities increase the attack surface and weaken least-privilege expectations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring explicitly describes a generic AI capability caller, which contradicts the specialized Tmall video skill description. This discrepancy is a supply-chain trust problem: users and orchestrators may approve the skill based on narrow metadata while the implementation advertises and contains broader powers.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module docstring and user-facing CLI text are written entirely in Chinese, and the skill does not state that language output is configurable or optional. This creates a natural-language policy concern because the skill effectively imposes a specific locale on users without opt-in or documented regional justification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Exposing user-info and wallet balance retrieval is unrelated to the stated Tmall video-generation purpose and grants access to account metadata a user may not expect this skill to touch. Even if the API response is legitimate, this violates least privilege and can enable unnecessary data exposure or reconnaissance about the user's account state.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The generic text chat command is outside the advertised scope of a Tmall video editing skill and allows arbitrary prompt submission to AI models. This broadens the skill from a constrained media workflow into a general AI interface, increasing the risk of misuse, data leakage through prompts, and policy circumvention via undeclared functionality.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Standalone image generation exceeds the stated video-generation/editing scope and gives the skill a second content-generation surface not implied by the metadata. In a marketplace or agent setting, this mismatch can be abused to perform undeclared actions, consume credits, or handle inputs that the user did not intend to expose to this skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The placeholder value for the API key includes Chinese text ('请替换为你的APIKey'), which imposes a specific language in a user-facing example. The file does not offer a language choice or document that the skill is intended only for Chinese-speaking users or a China-specific environment.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.