Volcengine Digital Human Video Generator

• Outcome: Review
• Latest audit: May 28, 2026 · 2:29 PM UTC
• Version: 1.0.4

Overview

This skill does what it claims, but it handles face images, voice audio, public uploads, automatic local file selection, and bundled cloud credentials in ways users should review carefully before installing.

Review before installing. Remove and rotate the bundled Volcengine credentials, configure your own scoped AK/SK, and only use images, scripts, and voice content you are comfortable sending to Volcengine and public file hosts. Prefer explicit image selection and avoid the latest-image default for private or shared environments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares powerful capabilities in practice—reading local files, using environment secrets, making network requests, and invoking shell/runtime dependencies—without an explicit permissions model. That creates a transparency and governance gap: reviewers and users cannot accurately assess what the skill can access, which increases the chance of over-privileged deployment and accidental data exposure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: This is a real security and privacy issue because the documented behavior understates materially sensitive actions: uploading user images and generated audio to public third-party hosts, fallback exfiltration to another host, and auto-reading the latest image from a fixed local directory. In context, this is more dangerous because the skill processes personal media; automatic selection of a local image risks using the wrong user's file, and public hosting exposes private biometric and voice data beyond the primary service provider.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The documentation instructs operators to upload generated or user-derived audio to a public third-party file-sharing service unrelated to the primary provider, which unnecessarily exposes potentially sensitive voice content to external retention, scraping, and unauthorized access. In the context of a digital-human skill that processes user photos and spoken content, this materially increases privacy and data-handling risk because the workflow depends on making private media publicly reachable.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill uploads user images and generated audio to public third-party file hosts unrelated to the declared provider flow, creating an unnecessary exfiltration path for sensitive biometric and voice data. Because the returned URLs are public, anyone with the link may access the content, and users are not warned at the upload points.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Selecting the latest image from a fixed inbound directory can cause the skill to process a different user's file or a stale sensitive image without explicit user intent. In a multi-user or shared-agent environment, this creates a cross-request data exposure risk and weakens input integrity.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: Broad trigger phrases can cause unintended invocation of a skill that handles local files and uploads media externally, which raises the risk of accidental processing of user content. In this context, false activation is more serious than for a harmless utility because invocation can lead to privacy-impacting uploads and use of API credentials without a clearly intentional user request.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The markdown normalizes public upload of audio without warning that the content becomes publicly accessible, which can disclose voice data, spoken text, personal information, or sensitive business content embedded in the narration. Because this skill creates user-facing digital-human videos from photos and dialogue, the omitted warning makes accidental privacy exposure more likely and more harmful than in a generic demo workflow.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code sends user-provided images and synthesized audio to public hosting services without clear runtime disclosure or consent, which is especially sensitive for face images and voice content. This creates a substantial privacy and data-handling risk beyond what users would reasonably expect from a digital-human generation skill.

Static analysis

No suspicious patterns detected.