Security audit

video-generation-minimax

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate MiniMax video-generation helper, but it gives the script more file-write and runtime latitude than its documentation clearly scopes.

Install only if you are comfortable sending prompts, image URLs, and any face-reference images to MiniMax. Run it in a constrained workspace, avoid sensitive personal images unless you have consent, and do not pass arbitrary --output paths until the script restricts output to a dedicated directory and refuses overwrites.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/video_gen.py:128
Finding: Unrestricted Output Path Allows Arbitrary File Overwrite
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/video_gen.py:103
Finding: Unbounded Network Requests, Polling, and Video Download
Content: View full analysis
Remediation: View remediation
MAX_VIDEO_BYTES: raise ValueError("Video exceeds the maximum permitted size") written = 0 with open(output_path, "xb") as output: for chunk in video_response.iter_content(chunk_size=1024 * 1024): if not chunk: continue written += len(chunk) if written > MAX_VIDEO_BYTES: raise ValueError("Video exceeds the maximum permitted size") output.write(chunk) ``` ]]>

T08 · Insecure Dependencies

Note

Location: SKILL.md:17
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Tainted flow: 'HEADERS' from os.environ.get (line 19, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/video_gen.py (reported line 32)May include surrounding context.
python
"duration": duration, "resolution": resolution, } response = requests.post(url, headers=HEADERS, json=payload) response.raise_for_status() task_id = response.json()["task_id"] return task_id

Tainted flow: 'HEADERS' from os.environ.get (line 19, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/video_gen.py (reported line 48)May include surrounding context.
python
"duration": duration, "resolution": resolution, } response = requests.post(url, headers=HEADERS, json=payload) response.raise_for_status() task_id = response.json()["task_id"] return task_id

Tainted flow: 'HEADERS' from os.environ.get (line 19, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/video_gen.py (reported line 65)May include surrounding context.
python
"duration": duration, "resolution": resolution, } response = requests.post(url, headers=HEADERS, json=payload) response.raise_for_status() task_id = response.json()["task_id"] return task_id

Tainted flow: 'HEADERS' from os.environ.get (line 19, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/video_gen.py (reported line 86)May include surrounding context.
python
"duration": duration, "resolution": resolution, } response = requests.post(url, headers=HEADERS, json=payload) response.raise_for_status() task_id = response.json()["task_id"] return task_id

Tainted flow: 'HEADERS' from os.environ.get (line 19, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/video_gen.py (reported line 102)May include surrounding context.
python
while True: time.sleep(10) response = requests.get(url, headers=HEADERS, params=params) response.raise_for_status() response_json = response.json() status = response_json["status"]

Tainted flow: 'HEADERS' from os.environ.get (line 19, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/video_gen.py (reported line 118)May include surrounding context.
python
while True: time.sleep(10) response = requests.get(url, headers=HEADERS, params=params) response.raise_for_status() response_json = response.json() status = response_json["status"]

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documentation indicates capabilities that access environment variables and external network resources, but it does not declare any explicit tool scope or permission boundary. This weakens auditability and can cause the agent to use broader capabilities than reviewers or users expect, especially since the skill reads an API key and sends content to a third-party service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill asks for prompts, image URLs, and face photos, but the description does not clearly warn that this data is transmitted to the external MiniMax API. This creates a privacy and consent risk, particularly for sensitive images like face photos, because users may provide data without understanding it leaves the local environment.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction to automatically download generated video into the workspace and then send it to the user removes a human review checkpoint before data leaves the workspace. Even if the intended file is the generated video, automatic exfiltration patterns are dangerous because they normalize sending workspace-derived artifacts to users without verification of content, path, or accidental inclusion of sensitive material.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Multiple docstrings, status messages, and CLI help strings are presented only in Chinese, while the script itself does not provide any language selection or explain that it is intentionally Chinese-only. This creates a language-policy issue because users are forced into a specific locale without opt-in.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/video_gen.py (reported line 32)May include surrounding context.
python
"duration": duration, "resolution": resolution, } response = requests.post(url, headers=HEADERS, json=payload) response.raise_for_status() task_id = response.json()["task_id"] return task_id

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/video_gen.py (reported line 48)May include surrounding context.
python
"duration": duration, "resolution": resolution, } response = requests.post(url, headers=HEADERS, json=payload) response.raise_for_status() task_id = response.json()["task_id"] return task_id

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/video_gen.py (reported line 65)May include surrounding context.
python
"duration": duration, "resolution": resolution, } response = requests.post(url, headers=HEADERS, json=payload) response.raise_for_status() task_id = response.json()["task_id"] return task_id

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Subject-reference mode sends a face image reference to an external service without an explicit warning or consent checkpoint, even though face images may constitute sensitive biometric data. In a user-facing automation skill, this creates privacy and compliance risk because users may not realize such data is being transmitted off-platform.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: While external transmission is generally expected for this skill, this particular mode involves subject-reference face imagery, which is materially more sensitive than ordinary prompts or generic images. Sending biometric-related data to a third party without explicit disclosure or consent increases privacy and regulatory risk beyond baseline expected transmission.
Content: Scanner excerpt · scripts/video_gen.py (reported line 86)May include surrounding context.
python
"duration": duration, "resolution": resolution, } response = requests.post(url, headers=HEADERS, json=payload) response.raise_for_status() task_id = response.json()["task_id"] return task_id

Tainted flow: 'params' from requests.post (line 95, network input) → requests.get (network output)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/video_gen.py (reported line 102)May include surrounding context.
python
while True: time.sleep(10) response = requests.get(url, headers=HEADERS, params=params) response.raise_for_status() response_json = response.json() status = response_json["status"]

Tainted flow: 'params' from requests.post (line 95, network input) → requests.get (network output)

Medium

Category: Data Flow
Confidence: 65% confidence
Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
Content: Scanner excerpt · scripts/video_gen.py (reported line 118)May include surrounding context.
python
while True: time.sleep(10) response = requests.get(url, headers=HEADERS, params=params) response.raise_for_status() response_json = response.json() status = response_json["status"]

Tainted flow: 'download_url' from requests.get (line 120, network input) → requests.get (network output)

Medium

Category: Data Flow
Confidence: 88% confidence
Finding: The code downloads a URL taken directly from a prior API response without validating the scheme, domain, or size of the response. If the upstream API were compromised, misconfigured, or returned an unexpected URL, this could trigger server-side request forgery-like behavior, unexpected outbound requests, or retrieval of malicious/oversized content.
Content: Scanner excerpt · scripts/video_gen.py (reported line 124)May include surrounding context.
python
print(f"正在下载视频到 {output_path}...") with open(output_path, "wb") as f: video_response = requests.get(download_url) video_response.raise_for_status() f.write(video_response.content) print(f"视频已成功保存至 {output_path}")

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file presents core instructions and descriptions primarily in Chinese while some examples and labels are in English, but it does not tell users that the skill is intended for Chinese-speaking users or offer an alternate language option. This can violate a language/locale policy when a skill implicitly forces one language without user opt-in or justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.