Story Video Skill

• Outcome: Review
• Latest audit: May 29, 2026 · 9:36 PM UTC
• Version: 1.5.1

Overview

The skill largely matches its story-to-video purpose, but it can automatically run package-manager installs and uses API-key-backed network calls to configurable endpoints, so it needs review before installation.

Install only if you are comfortable sending story content and generated media prompts to MiniMax using your API key. Review or remove the ffmpeg auto-install logic first, and keep endpoint environment variables pointed only at trusted MiniMax-compatible HTTPS hosts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (17)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Try apt (Debian/Ubuntu/WSL)
        print("[INFO] Detected Linux — running: sudo apt-get update && sudo apt-get install -y ffmpeg")
        try:
            result = subprocess.run(
                ['sudo', 'apt-get', 'update'],
                capture_output=True, text=True, timeout=120
            )

• Confidence: 98% confidence
• Finding: This code automatically runs `sudo apt-get update` during normal skill execution, which expands the skill from media processing into system administration. In an agent context, executing privileged package-manager commands without explicit user approval can unexpectedly modify the host, pull network content, and create a serious trust-boundary violation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

)
            if result.returncode != 0:
                print(f"[WARN] apt-get update failed: {result.stderr.strip()}")
            result = subprocess.run(
                ['sudo', 'apt-get', 'install', '-y', 'ffmpeg'],
                capture_output=True, text=True, timeout=180
            )

• Confidence: 99% confidence
• Finding: Automatically executing `sudo apt-get install -y ffmpeg` can install new software with elevated privileges and network access, which is materially beyond the stated task of merging videos. In an automation or agent environment, this can alter the system state, install unexpected dependencies, and be abused if package sources or execution context are compromised.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# macOS — try brew
        print("[INFO] Detected macOS — running: brew install ffmpeg")
        try:
            result = subprocess.run(
                ['brew', 'install', 'ffmpeg'],
                capture_output=True, text=True, timeout=300
            )

• Confidence: 96% confidence
• Finding: Running `brew install ffmpeg` from the skill gives it package-installation capability and network reach outside its core function. Even without `sudo`, unattended installation changes the host environment and violates the principle of least surprise for a content-processing skill.

Tainted flow: 'T2I_URL' from os.environ.get (line 16, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

# ── API helpers ─────────────────────────────────────────────────────────────
def t2i_generate(visual_prompt):
    """调用 MiniMax T2I，返回 (img_url, error_msg)"""
    resp = requests.post(T2I_URL, headers=get_headers(), json={
        "model": "image-01",
        "prompt": visual_prompt,
        "aspect_ratio": "16:9"

• Confidence: 90% confidence
• Finding: The destination URL is derived from MINIMAX_BASE_URL, an environment variable, and the request includes the Bearer API key in Authorization headers. If an attacker can influence the environment, they can redirect requests to an attacker-controlled host and capture the credential and all submitted prompts/content.

Tainted flow: 'I2V_URL' from os.environ.get (line 17, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

def i2v_submit(img_url, prompt):
    """提交 I2V 任务，返回 (task_id, error_msg)"""
    try:
        resp = requests.post(I2V_URL, headers=get_headers(), json={
            "model": "MiniMax-Hailuo-2.3",
            "first_frame_image": img_url,
            "prompt": prompt[:200],

• Confidence: 90% confidence
• Finding: This POST sends sensitive data and the Authorization bearer token to a URL built from an environment-controlled base. A malicious or compromised runtime environment could redirect video-generation requests to an attacker server, causing credential leakage and exfiltration of user content.

Tainted flow: 'RETRIEVE_URL' from os.environ.get (line 19, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

def get_download_url(file_id):
    try:
        resp = requests.get(RETRIEVE_URL, headers=get_headers(),
                           params={"file_id": file_id}, timeout=30)
        resp.raise_for_status()
        return resp.json().get("file", {}).get("download_url")

• Confidence: 87% confidence
• Finding: The file-retrieve request also uses the environment-derived base URL and includes authorization headers. If the base URL is attacker-controlled, the script can disclose its API token and retrieval metadata to an external system.

Tainted flow: 'POLL_URL' from os.environ.get (line 18, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

start = time.time()
    while time.time() - start < timeout:
        try:
            resp = requests.get(POLL_URL, headers=get_headers(),
                                params={"task_id": task_id}, timeout=30)
            resp.raise_for_status()
            result = resp.json()

• Confidence: 87% confidence
• Finding: Polling requests are sent to a URL constructed from environment input and include the bearer token. An attacker who can set MINIMAX_BASE_URL could redirect these authenticated polling calls and harvest the token or manipulate workflow behavior.

Tainted flow: 'API_ENDPOINT' from os.environ.get (line 26, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

"parameters": {"aspect_ratio": "16:9"}
    }
    
    response = requests.post(
        API_ENDPOINT,
        headers=headers,
        json=payload,

• Confidence: 95% confidence
• Finding: The request destination is taken from the MINIMAX_IMAGE_URL environment variable and then used directly in requests.post while sending the bearer token in the Authorization header. If an attacker can influence the runtime environment, they can redirect the request to an attacker-controlled server and capture the API key and all prompts, making this an SSRF-style credential exfiltration risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill documentation describes execution paths that use environment variables, local file I/O, network access, and shell commands, yet it declares no permissions or capability boundaries. This creates a trust and consent gap: users or hosts may invoke a skill that can access secrets, write artifacts, contact third-party APIs, and run local commands without an explicit permission model.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose understates important behaviors such as attempting system-level ffmpeg installation, producing additional output artifacts, and relying on external MiniMax services. This mismatch is dangerous because operators may approve the skill for content generation while unaware it can execute privileged package-management commands and transmit data externally, increasing the chance of unintended system modification and data exposure.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The skill contains built-in software-installation logic for multiple platforms, meaning it can modify the local system rather than only process media. In an agent setting, that broader capability significantly increases risk because a simple content task now includes package management, network access, and system-state changes.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script transmits image URLs and generation metadata to an external third-party API without any explicit user-facing notice or consent step. In a content-production pipeline, those URLs or prompts may contain sensitive or unpublished material, so silent exfiltration to a vendor increases privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The runtime flow attempts installation automatically when ffmpeg is missing, without any prior confirmation prompt from the user. In an agent workflow, this can lead to surprising privileged actions and host modification from what appears to be a simple media utility.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script sends full story content to a third-party LLM service without any explicit consent prompt, disclosure, or content-sensitivity checks. In this skill context, users may provide unpublished scripts, private narratives, or sensitive creative material, making silent external transmission a real privacy and confidentiality risk.

Ssd 4

Medium

• Confidence: 91% confidence
• Finding: User-controlled story text is interpolated directly into the prompt with only weak natural-language instructions separating data from control. A crafted story can inject prompt directives that cause the model to ignore the intended task, produce malformed or adversarial output, or generate content that disrupts downstream processing in this video pipeline.

External Transmission

Medium

• Category: Data Exfiltration

Content

| 变量 | 必需 | 默认值 | 说明 |
|------|------|--------|------|
| `MINIMAX_API_KEY` | ✅ | — | MiniMax API密钥 |
| `MINIMAX_BASE_URL` | ❌ | `https://api.minimaxi.com/v1` | MiniMax API地址 |
| `MINIMAX_IMAGE_URL` | ❌ | `https://api.minimaxi.com/v1/image_generation` | 图片生成端点 |

## 目录结构

• Confidence: 90% confidence
• Finding: The skill is designed to send user-provided story text, prompts, and generated assets to an external MiniMax endpoint. In this context, external transmission is expected, but it remains security-relevant because creative content, possibly sensitive scripts, and API-backed requests leave the local environment and are processed by a third party.

External Transmission

Medium

• Category: Data Exfiltration

Content

|------|------|--------|------|
| `MINIMAX_API_KEY` | ✅ | — | MiniMax API密钥 |
| `MINIMAX_BASE_URL` | ❌ | `https://api.minimaxi.com/v1` | MiniMax API地址 |
| `MINIMAX_IMAGE_URL` | ❌ | `https://api.minimaxi.com/v1/image_generation` | 图片生成端点 |

## 目录结构

• Confidence: 90% confidence
• Finding: The image-generation endpoint indicates another explicit external data flow to a third-party service. Because the skill context is a media-generation pipeline, this behavior is not inherently malicious, but it can expose sensitive prompts, story content, or derived media if users are not clearly warned and given control over egress.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.