Security audit

AI Influencer

Security checks for vulnerabilities and agentic risk

Overview

This skill is framed as a real AI video-generation pipeline, but its bundled script only simulates the work and reports success without creating the claimed output.

Review this skill before installing. Do not rely on it to produce a real video in its current form, and do not provide API keys, face images, voice material, or scripts unless the implementation is corrected, privacy handling is clearly documented, and outputs are verified.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: scripts/influencer_pipeline.py:1
Finding: Unpinned and Unused Third-Party Dependencies
Content: View full analysis
Vulnerability Details

File Location: scripts/influencer_pipeline.py, lines 1-7
Vulnerability Type: Unpinned dependency resolution and unnecessary supply-chain exposure
Risk Level: Medium

Evidence

python
# /// script # requires-python = ">=3.12" # dependencies = [ # "pyjwt", # "requests", # ] # ///

The documented invocation in SKILL.md, line 27, uses uv run:

bash
uv run {baseDir}/scripts/influencer_pipeline.py \ --image "/path/to/reference.png" \ --prompt "A man sitting at a desk looking at the camera, subtle natural movement, calm, talking head" \ --text "This is the script that the AI avatar will speak." \ --voice-id "YOUR_ELEVENLABS_VOICE_ID"

Technical Analysis

The inline dependency metadata declares pyjwt and requests without exact versions, integrity hashes, or a reviewed lockfile. Running the script through uv run can therefore resolve and install dependency releases available from the configured package index at execution time.

Neither package is imported or used by the current script, so this supply-chain exposure serves no functional purpose. The effective dependency set can also change between executions without any modification to the audited repository. If a package release, transitive dependency, configured package index, or source distribution is compromised, dependency resolution or build processing may expose the host to attacker-controlled code.

Attack Path

An attacker compromises a declared package, one of its transitive dependencies, or a package source trusted by the runtime environment.

The attacker publishes a malicious release that satisfies the unconstrained dependency declaration.

A user or Agent invokes the documented uv run command.

uv resolves the unpinned dependency set and may download or build the attacker-controlled release.

Malicious build or package behavior executes ...[truncated 654 chars]
Remediation: View remediation
Remediation Suggestions

Remove pyjwt and requests from the inline metadata while they remain unused.

When API integration is implemented, pin each direct dependency to an exact, reviewed version.

Maintain a committed lockfile and use frozen or locked dependency resolution in automated execution.

Verify package integrity through trusted indexes and hashes where the package workflow supports them.

Review transitive dependencies and reject unexpected source distributions or package-index overrides.

Run the pipeline as a minimally privileged account and provide API credentials only for the duration of the operation.

Add automated dependency scanning and controlled update review to the release process.

T07 · Tool Hijacking and Spoofing

Note

Location: scripts/influencer_pipeline.py:36
Finding: Pipeline Spoofs Successful API Operations and Output Generation
Content: View full analysis
Vulnerability Details

File Location: scripts/influencer_pipeline.py, lines 36-54
Vulnerability Type: API and output-result spoofing
Risk Level: Low

Evidence

python
print("\n[Step 2] Voice Cloning (ElevenLabs)") print(f"Generating speech for: '{args.text[:30]}...' using Voice ID {args.voice_id}") time.sleep(1) print("✅ Audio track generated (audio.mp3).") print("\n[Step 3] Kling AI Lip-Sync & Animation") print("Uploading assets to Kling API and requesting Avatar generation...") # This represents the identify-face + advanced-lip-sync workflow we built time.sleep(1) print("⏳ Waiting for Kling rendering (this usually takes 5-10 minutes)...") time.sleep(2) print("\n🎉 SUCCESS! Your AI Influencer video has been generated.") print("Output saved to: ./final_influencer_video.mp4")

Technical Analysis

The script reports that speech was generated, assets were uploaded to Kling, rendering completed, and a final video was saved. However, the audited implementation contains no HTTP requests, image processing, audio generation, file creation, or output validation. It only checks whether credential environment variables exist, prints status messages, and waits using time.sleep.

Consequently, the command exits successfully and presents simulated activity as completed API work. This contradicts the operational behavior described in SKILL.md and can mislead an Agent or downstream workflow into treating nonexistent artifacts as valid results.

This finding does not demonstrate credential theft or malicious replacement of an installed system tool. It concerns the script's spoofing of API activity and successful tool output.

Attack Path

A user or Agent follows SKILL.md and invokes the pipeline with the required arguments.

The environment contains nonempty values for the three required credential variables, allowing the superficial checks to pass.

The script performs fixe ...[truncated 1078 chars]
Remediation: View remediation
Remediation Suggestions

Until the integrations are implemented, terminate with a nonzero exit status and an explicit message that the pipeline is a simulation.

Do not print success messages for operations that were not performed.

Implement authenticated API requests with explicit timeouts, response-status validation, bounded retries, and safe error handling.

Track asynchronous rendering through a real job identifier and report completion only after the provider confirms success.

Download generated artifacts to an explicitly selected output path and write them atomically.

Verify that output files exist, are newly created, are nonempty, and have an expected media format before returning success.

Return machine-readable status information so Agents do not have to infer completion from decorative console text.

Update SKILL.md to distinguish mocked behavior from implemented functionality.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill claims to automate identity generation, voice cloning, and video rendering through named third-party services, but the described implementation does not actually perform those actions and may falsely report successful output. This is dangerous because users may trust fabricated results, mishandle sensitive media under false assumptions, or approve a workflow that has not been honestly described or validated.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes a script that relies on environment secrets and external network access, but the manifest does not declare any tool scope or permissions. This weakens policy enforcement and informed review because an operator cannot easily see that the skill needs outbound API access and secret material to function.
Content: No source excerpt is available for this finding.

Missing User Warnings