Skill Tiktok Ads Video

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:13 AM UTC
• Version: 2.1.0

Overview

This is a local video-captioning skill with some documentation and dependency-hygiene issues, but no evidence of hidden data access, exfiltration, persistence, or destructive behavior.

Install only if you are comfortable running a local Python video-processing script that resolves third-party packages. For sensitive environments, use a locked dependency environment or sandbox. Also note that the current script is narrower than the README: it does not actually mix background audio or consume the documented captions JSON, and its ad copy includes UAE/AED-specific text.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/overlay.py:3

Finding

Unpinned Runtime Dependencies Allow Mutable Supply-Chain Code Execution

Content

View full analysis

Vulnerability Details

File Location: scripts/overlay.py:3-5
Additional Location: SKILL.md:17, SKILL.md:49
Vulnerability Type: Unpinned third-party runtime dependencies
Risk Level: Medium

Vulnerable Code

python

# /// script
# requires-python = ">=3.10"
# dependencies = ["moviepy>=2.0", "pillow>=10.0", "numpy"]
# ///

The documented execution commands also resolve dependencies dynamically:

bash

uv run --with moviepy --with pillow scripts/overlay.py \
  --video base.mp4 \
  --output final.mp4 \
  --product rain_cloud \
  --style subtitle_talk

Technical Analysis

The script declares mutable dependency ranges for moviepy and pillow, while numpy has no version constraint. The documented uv run --with workflow can resolve and install packages at execution time. The project does not include a reviewed lockfile, exact package versions, or package hashes.

Consequently, the code executed by the Skill can change even when the audited project files remain unchanged. If an allowed future dependency release or its distribution account is compromised, malicious package initialization code may execute when the dependency is installed or imported. Broad constraints can also introduce incompatible releases, although compatibility failures alone are a reliability concern rather than a security vulnerability.

Attack Path

1. An attacker compromises an upstream dependency release or its package-publishing account.
2. The attacker publishes a malicious version satisfying the declared constraints, such as a later moviepy or pillow release, or any selected numpy version.
3. A user follows the documented uv run --with moviepy --with pillow execution workflow in an environment without a previously verified, immutable resolution.
4. uv resolves and installs the attacker-controlled package version.
5. Malicious package code executes during installation or Python import.
6. The payload runs with the privileges and ...[truncated 898 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace broad dependency ranges with exact, reviewed versions for every direct dependency, including numpy.
2. Generate and commit a uv lockfile containing the complete transitive dependency graph.
3. Require execution in locked or frozen mode so dependency resolution fails rather than silently selecting newer versions.
4. Use hash verification for downloaded distributions where supported.
5. Restrict package resolution to an explicitly configured, trusted registry and disable unintended supplemental indexes to reduce dependency-confusion exposure.
6. Update the documented commands so they use the project's locked environment instead of unconstrained --with moviepy --with pillow resolution.
7. Perform dependency updates through a controlled review process that includes vulnerability scanning, provenance checks, and testing before regenerating the lockfile.
8. Run video processing in a sandbox or container with minimal filesystem access, no unnecessary credentials, and restricted network access to reduce the impact of a compromised dependency.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code broadly matches the core idea of creating TikTok-style ad videos with animated caption overlays on a base MP4 using built-in presets. It includes multiple overlay styles, timing logic, CTA pills, and video export. However, the description claims it 'mixes background audio,' while the code explicitly preserves native audio and performs no background music loading, mixing, or audio composition. Also, while the description says no captions JSON is needed due to product presets, the implementation is narrower than implied: it only supports three hardcoded product templates and no general caption input path. The primary mismatch is the undeclared absence of background audio mixing, which is a material part of the declared purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This JSON content includes region-specific natural language such as the UAE currency and delivery area ('149 AED' and 'Free delivery UAE'). Under the policy rule for natural-language locale constraints, this forces a specific locale/region in the generated content without any opt-in or documented justification in the file itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.