Videosays - Video to Text Transcription

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:46 AM UTC
• Version: 1.0.2

Overview

The skill does what it claims, but it repeatedly runs an unpinned npm CLI that may execute newly changed third-party code while handling API credentials and private video links.

Review before installing. Use this skill only if you trust the Videosays CLI supply chain and are comfortable sending video links/share text and API credentials to Videosays. Prefer pinning the CLI to a reviewed exact version, running it in a constrained environment, and using secure temporary files that are deleted after batch submission.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:19

Finding

Unpinned Third-Party npm Package Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–25
Vulnerability Type: Unpinned and mutable third-party dependency execution
Risk Level: High

Vulnerable Code

bash

npx videosays whoami

If authentication is missing, run:

bash

npx videosays login

Ask the user to open the printed authorization URL, sign in, and approve the CLI. If the user explicitly provides an API key, run npx videosays login --api-key "$VIDEOSAYS_API_KEY". Never print or reveal the API key.

Technical Analysis

The Skill instructs the Agent to invoke npx videosays without specifying an exact package version, lockfile, package integrity hash, or trusted installation source. Depending on the local npm configuration and cache state, npx can retrieve the package from the configured npm registry and immediately execute its entry point.

Consequently, the code executed by the Agent is mutable after this Skill has been audited. Compromise of the package, its publisher account, one of its transitive dependencies, or the configured package registry could cause future invocations to execute malicious code. This is especially sensitive during the login command because the process may receive VIDEOSAYS_API_KEY and other environment variables.

Attack Path

1. An attacker compromises the videosays package publisher, a transitive dependency, or the npm registry resolution path.
2. The attacker publishes or serves a malicious package version.
3. An Agent follows the Skill and runs an unversioned npx videosays command.
4. npx downloads and executes the attacker-controlled package with the Agent process's operating-system privileges.
5. The malicious package reads accessible environment variables, including a supplied API key, and may access or alter files and make network requests within the Agent's permission boundary.

Impact Assessment

Successful exploitation permits arbitrary code executio ...[truncated 414 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to an explicitly reviewed version, such as npx --yes videosays@<exact-version>, rather than resolving the latest available release.
• Prefer a project-local installation governed by a committed lockfile and npm integrity metadata.
• Verify package provenance, signatures, publisher identity, and integrity before installation.
• Use a trusted registry and disable unexpected registry overrides or dependency sources.
• Run the CLI in a sandbox with minimal filesystem, environment-variable, and network access.
• Expose only the credential required for the specific invocation instead of inheriting the Agent's complete environment.
• Establish a controlled update and re-audit process before changing the pinned version.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:67

Finding

Predictable Temporary File May Expose Private Video Links and Share Text

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 67–73
Vulnerability Type: Unsafe temporary-file handling and plaintext retention
Risk Level: Medium

Vulnerable Code

text

1. Write one link or share text per line to a temporary text file. Keep duplicate lines when the user requested duplicate work; each line is an independent batch item and Task.
2. Submit once:

bash

VIDEOSAYS_CLIENT_SURFACE=agent_skill VIDEOSAYS_CLIENT_NAME=videosays-skill npx videosays batch links.txt

Technical Analysis

The Skill recommends writing user-supplied links or share text to a temporary file but uses the predictable relative filename links.txt. It does not require secure atomic file creation, restrictive permissions, symlink protection, collision checks, or deletion after submission.

Video links and share text may contain private resource identifiers, invitation data, signed query parameters, or bearer-like access tokens. Storing this information in an ordinary workspace file can leave it available after the batch operation. A pre-existing file or symbolic link named links.txt can also cause unintended overwrite behavior when the Agent creates the input file.

Attack Path

1. A user provides private video URLs or share text containing sensitive identifiers or access parameters.
2. The Agent follows the Skill and writes the values to the predictable path links.txt.
3. The file is created with permissions determined by the process umask and remains in the workspace because no cleanup is required.
4. Another process, user, later Agent session, backup operation, or artifact collector with access to the workspace reads the retained plaintext.
5. Where an attacker can pre-create workspace entries, a malicious file or symbolic link named links.txt may additionally redirect or interfere with the write operation.

Impact Assessment

Exploitation can disclose every video link or share-tex ...[truncated 331 chars]

Remediation

View remediation

Remediation Suggestions

• Create the batch input with an operating-system secure temporary-file API that generates an unpredictable filename atomically.
• Set owner-only permissions, such as mode 0600, before writing sensitive input.
• Use an absolute path and ensure that the created object is a regular file rather than a symbolic link.
• Avoid creating the file in a shared project directory or other location collected as an artifact.
• Delete the file in a guaranteed cleanup step immediately after submission, including error and cancellation paths.
• Document that URLs containing signed parameters or credentials are sensitive and must not be logged.
• Where supported by the CLI, replace file-based transfer with standard input or another mechanism that does not persist plaintext to disk.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

5. Repeat status checks until the batch reaches `completed`, `partial`, `failed`, or `cancelled`.

Every `batch <file>` submission creates a new server Batch ID, even when the file contents are unchanged. Batch submission and status commands return promptly. Do not rerun the input file as a status check, do not invent a Batch ID, and do not use `batch resume`.

If batch submission ends before printing a Batch ID, do not automatically submit the file again: the server may already have accepted it, and another submission creates another batch. Report the ambiguous outcome and get confirmation before creating a replacement batch.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The skill repeatedly instructs the agent to run npx videosays without pinning an exact package version. npx may fetch the latest published package at execution time, so a compromised maintainer account, malicious update, or dependency hijack could cause arbitrary code execution in the agent environment before any transcription logic runs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This invocation uses unpinned npx videosays, which can download and execute whatever version is current on the registry. That creates a software supply-chain execution path where a malicious or trojanized release could exfiltrate credentials or run arbitrary commands in the host context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The login flow depends on an unversioned package fetched via npx, so authentication may be handled by unreviewed code if the upstream package changes. Because this command touches authorization state and may display or process login URLs, compromise here can directly affect account security and token handling.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 99% confidence

Finding

Using npx videosays login --api-key without version pinning is especially sensitive because the command processes API credentials. A malicious package version could capture the provided API key or leak environment variables while appearing to authenticate normally.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This transcription command executes an unpinned external package through npx, exposing the agent to arbitrary code execution from the package supply chain. The command also handles user-supplied links/share text, so compromise could pair code execution with sensitive input collection or exfiltration.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Polling task status via unpinned npx videosays still causes runtime resolution of remote code and is therefore vulnerable to registry or maintainer compromise. Even seemingly read-only commands can execute arbitrary preinstall/postinstall or CLI logic on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The timeline status example invokes an unpinned package, so the same supply-chain risk applies here. Because the skill normalizes repeated use of npx, it increases the number of opportunities for a compromised release to be pulled and executed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The SRT status example fetches and executes videosays without a fixed version, preserving the same arbitrary code execution risk through the package registry. Attackers need only compromise the package path once to affect all command variants described by the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

This VTT status example also relies on an unpinned npx package, which is dangerous because execution trust is delegated to the current registry state. The issue is systemic across the skill rather than isolated to a single command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Checking history with npx videosays remains a true supply-chain risk because npx can install and run updated code on demand. A malicious package could inspect prior task metadata, local files, or credentials while masquerading as a harmless history query.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Batch submission via unpinned npx videosays is vulnerable to arbitrary code execution through package compromise. Because batch mode aggregates multiple user-provided links in a file, a compromised CLI could also exfiltrate bulk input data and metadata.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The batch status command is another unpinned npx execution point, so it inherits the same package supply-chain threat. Repeated polling amplifies exposure because the agent may invoke the package many times during a single user request.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Continuing a batch after insufficient credits still executes unversioned registry code via npx. Since this action changes remote job state, a compromised package could both manipulate workflow outcomes and misuse local environment access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The optional --wait transcription path also uses an unpinned package, maintaining the same remote-code execution risk. A long-running attached session can further increase blast radius if malicious code abuses the live terminal context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The batch --wait example likewise resolves videosays dynamically from the registry. Combined with an attached waiting session, a compromised release could maximize dwell time and opportunities for exfiltration or deceptive output.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The balance command appears low risk functionally, but it still executes an unpinned third-party package through npx. Any package compromise would grant code execution regardless of whether the command is read-only from the user's perspective.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The history command is another instance of unpinned npx execution, so it is a true vulnerability for the same supply-chain reasons. Consistency across the document means the unsafe pattern is embedded in normal operation, not a one-off oversight.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The batch cancel command also relies on a floating npx package version, exposing the host to arbitrary code execution if the package path is compromised. Since this command mutates remote state, malicious code could additionally perform unauthorized actions under the user's account.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.