Security audit

多平台生成视频导演

Security checks for vulnerabilities and agentic risk

Overview

This skill is an end-to-end video creation helper with disclosed local editing scripts and optional online TTS, with no evidence of hidden theft, persistence, or destructive behavior.

Install this if you want a video generation and editing workflow. Expect it to use user-supplied images/videos, call VideoGen when available, run local Python media scripts on specified files, optionally install Python packages, and use edge-tts for voice lines when requested. Avoid sending sensitive text to TTS services unless that is acceptable, and confirm credit-consuming video generation before running it.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill instructs use of shell-capable workflows and local Python scripts but does not declare corresponding permissions. This creates a trust and containment gap: an agent may perform file manipulation, dependency installation, media processing, or network-adjacent actions without the platform exposing that capability to reviewers or users. In a skill that handles user-supplied files, undeclared shell access increases the risk of unintended command execution paths and overbroad file access.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared purpose says the skill only does video generation, but the document also enables subtitle burning, audio synthesis, TTS voice generation, media muxing, probing, and multi-clip editing. This mismatch prevents accurate risk review and user consent, because the real behavior includes shell execution, dependency installation, and networked voice synthesis beyond the stated scope. Hidden expansion of capability is dangerous because it broadens data handling and execution privileges without transparent disclosure.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill explicitly claims it only handles video generation, yet the body operationalizes music composition, subtitle rendering, TTS dubbing, and final edit assembly. This is a substantive scope deception issue, not merely wording drift, because those extra functions introduce additional execution paths, dependencies, and potentially network use. Users and auditors may approve the skill under a narrower trust model than the one actually implemented.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The skill directs runtime installation of Python dependencies and use of edge-tts, which requires network access, even though these are not core to a narrowly defined video-director skill. Installing packages at runtime increases supply-chain and execution risk, while networked TTS expands data exposure if user text or derived content is sent to external services. These behaviors become more sensitive because they are bundled into a skill primarily framed as prompting/generation orchestration rather than code execution.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger phrase at line 21 is broad enough to match many ordinary user requests, which can cause this skill to be invoked when the user did not specifically intend to use a video-generation workflow. Unintended invocation is risky here because the skill is capable of steering multi-step media generation behavior and could divert requests away from more appropriate tools or workflows.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger list contains multiple generic phrases such as common video-related terms, increasing the chance of accidental routing to this skill for loosely related requests. In this context, the danger is elevated because the skill claims broad end-to-end handling across planning, prompting, audio, subtitles, and direct generation, so an unintended match could misroute user tasks and trigger unnecessary or incorrect tool use.

Static analysis

No suspicious patterns detected.