Vidu — AI Video Generation - Vidu Q3 & Vidu 2.0

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:38 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed Atlas Cloud video generator, but its Vidu-focused description is broader in practice and can use a billing API key for arbitrary Atlas Cloud video models and local media upload.

Review before installing. Only use this with prompts and media you are comfortable sending to Atlas Cloud, and with an Atlas Cloud API key whose billing exposure you accept. Be aware that despite the Vidu branding, the bundled script can access broader Atlas Cloud video models and upload local files when directed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill advertises narrowly scoped Vidu functionality, but the documented behavior indicates acceptance of arbitrary Atlas Cloud video models and undeclared local file upload. That mismatch can mislead operators and routing logic, causing users to authorize broader data transfer and model execution than they intended.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger text is excessively broad and can match many ordinary requests about making videos, marketing clips, reels, or animations. Overbroad activation increases the probability that the skill is invoked in contexts where users did not intend third-party transmission of prompts, images, or videos to Atlas Cloud.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill requires environment access to a billing-capable API key and performs network operations, but it declares no explicit tool scope or permission boundaries. This increases the chance that an agent runtime invokes the skill with broader capabilities than intended, enabling unintended outbound requests or misuse of sensitive credentials.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Step 1: Submit
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: The documented endpoint hard-codes transmission to api.atlascloud.ai, confirming dependence on an external network destination for task execution. Without scoped permissions and consent controls, this can expose sensitive content or enable unintended spending through API-key-backed requests.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Step 1: Submit
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: The documented endpoint hard-codes transmission to api.atlascloud.ai, confirming dependence on an external network destination for task execution. Without scoped permissions and consent controls, this can expose sensitive content or enable unintended spending through API-key-backed requests.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Returns: { "code": 200, "data": { "id": "prediction-id" } }

# Step 2: Poll (every 5 seconds until completed)
curl -s "https://api.atlascloud.ai/api/v1/model/prediction/{prediction-id}" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY"
# Returns: { "code": 200, "data": { "status": "completed", "outputs": ["https://...video-url..."] } }

• Confidence: 87% confidence
• Finding: Polling the external prediction endpoint repeatedly extends the external interaction window and can leak request metadata such as prediction IDs and job status to a third party. While expected for asynchronous processing, it still represents continued transmission outside the local environment and can amplify cost or observability concerns.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Image-to-Video Example (Q3-Pro)

```bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 92% confidence
• Finding: The image-to-video example transmits an image URL and prompt to the external API, which may reveal user-controlled media locations or sensitive content. In a media-generation skill, this is contextually expected, but it is still dangerous if users are not clearly informed that their inputs leave the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Anime Style Example (Q3-Pro)

```bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 89% confidence
• Finding: The anime-style example demonstrates another external submission path for user prompts and generation parameters. Even though it is functionally similar to the main generation flow, each documented invocation path reinforces that the skill routinely exports user content to a third-party service with associated billing and privacy implications.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Start-End Interpolation Example (2.0)

```bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 92% confidence
• Finding: The start-end interpolation example sends two image inputs and a prompt externally, increasing the volume and sensitivity of transmitted user media. This is more dangerous than text-only usage because personal or proprietary images may be exposed to a third party if the user is not adequately warned.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Reference-to-Video Example (2.0)

```bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 93% confidence
• Finding: Reference-to-video submission sends one or more reference images that are specifically intended to preserve character or object consistency, making them likely to contain identifiable or proprietary material. In this context, external transmission is expected but materially privacy-sensitive because it may expose likenesses, branded assets, or confidential creative references.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The manifest presents this skill as a Vidu-focused video generator supporting specific Vidu model families and features, but the script is implemented as a generic Atlas Cloud video client. It accepts arbitrary model IDs, lists all available video models from Atlas Cloud, and the examples reference non-Vidu models such as alibaba/wan-2.6, which broadens behavior beyond the claimed Vidu-specific functionality.

Intent-Code Divergence

Medium

• Confidence: 81% confidence
• Finding: The skill manifest emphasizes start-end-to-video capability, but the file docstring states support for text-to-video, image-to-video, video-to-video, and local file upload. The implemented CLI also exposes --video/--videos inputs, with no explicit start-frame/end-frame interface, so the documented intent diverges from the advertised capability set.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.