Yummy Gen Video

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:19 AM UTC
• Version: 1.1.0

Overview

The skill appears aimed at Gemini Veo video generation, but it relies on an unpinned third-party executable CLI and shell-style command templates that need review before installation.

Install only if you trust the @yummysource/yummycli package and its update process. Prefer a pinned, reviewed version, run it with only the needed GEMINI_API_KEY exposed, and ensure prompts and file paths are passed as literal CLI arguments rather than assembled into a shell command string.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Executable npm Dependency Creates a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:46

Finding

User-Controlled Prompt and Path Values May Be Unsafely Interpolated into Shell Commands

Content

View full analysis

" ``` ```bash yummycli gemini veo \ --prompt "" \ --input-image ./frame.png \ --input-image ./style.jpg ``` ```bash --output --model --aspect-ratio --duration --resolution ``` ### Technical Analysis The skill instructs an agent to place user-provided prompts, image paths, output paths, and other values into command-line templates. It does not require invocation through a structured argument array, disable shell interpretation, or define platform-appropriate escaping. Double quotation marks alone do not make arbitrary input safe for shell execution. In common shells, constructs such as command substitution can still be evaluated inside double-quoted strings. Input containing quotation marks, shell metacharacters, substitutions, newlines, or option-like path values may alter the intended command when an implementation constructs one shell string. For example, if an implementation replaces `` directly in the documented template and executes the resulting text through a shell, a prompt containing a shell substitution could cause an additional local command to run. A quote-breaking value followed by shell operators could similarly terminate the intended argument and append another command. The Markdown file itself does not execute these commands, so exploitation depends on the consuming agent or integration using shell-string interpolation. The absence of safe invocation requirements nevertheless makes that implementation error reasonably likely. ### Attack Path 1. An attacker supplies a crafted video prompt, input-image path, or output path containing shell syntax. 2. The agent substitutes the untrusted value into one o ...[truncated 1261 chars]

Remediation

View remediation

- --input-image - shell: false ``` 2. Explicitly prohibit command construction through string concatenation, template substitution, `eval`, `sh -c`, `bash -c`, or equivalent shell-enabled APIs. 3. If a shell cannot be avoided, apply rigorously tested, platform-specific argument escaping to every untrusted value. Generic quoting or simple character replacement is insufficient. 4. Validate `--output` with an allowlisted `.mp4` extension and enforce an approved output directory. 5. Resolve and validate image paths before execution. Require regular local image files and reject unexpected device files, pipes, control characters, and path traversal outside approved directories. 6. Insert an argument terminator where supported and reject ambiguous path values beginning with `-` to prevent option confusion. 7. Treat prompts as opaque data and preserve them as one literal argument regardless of embedded quotes, substitutions, newlines, or metacharacters. 8. Add automated tests using prompts and paths containing quotes, spaces, newlines, `$()`, backticks, semicolons, ampersands, and platform-specific metacharacters to verify that no secondary command is executed. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger guidance says to load the skill when the user asks to "generate, create, or animate a video using AI," which is a broad natural-language condition rather than a narrowly bounded invocation rule. It lacks negative examples or exclusion conditions, so ordinary requests about AI video creation could cause unintended activation even when a different tool or provider was intended.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.