Skill Tiktok Video Pipeline

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:18 AM UTC
• Version: 2.0.0

Overview

The skill is a plausible TikTok video generator, but unsafe command and path handling could let crafted inputs run unintended commands or write outside the intended output folder.

Review before installing. Run only in a low-privilege, disposable workspace with trusted inputs, avoid exposing unrelated secrets in the environment, and fix command construction, path containment, input validation, and dependency pinning before using it for production or shared automation.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate.js:69

Finding

Arbitrary Command Execution Through Shell Command Injection

Content

View full analysis

/dev/null`); return; } const r = run(cmd); ``` ```javascript const cmd = [ 'uv run', JSON.stringify(OVERLAY_SCRIPT), '--input', JSON.stringify(baseVideoPath), '--output', JSON.stringify(overlayedPath), '--captions', JSON.stringify(opts.scriptText), '--lang', opts.lang, logoFlag, ].filter(Boolean).join(' '); const r = run(cmd); ``` ```javascript const cmd = [ 'ffmpeg -y', `-i ${JSON.stringify(overlayedPath)}`, `-i ${JSON.stringify(audioSrc)}`, '-filter_complex', '"[0:a]volume=1.0[va];[1:a]volume=0.20[bgm];[va][bgm]amix=inputs=2:duration=first:dropout_transition=2[aout]"', '-map 0:v', '-map "[aout]"', '-c:v copy', '-c:a aac -b:a 192k', '-shortest', JSON.stringify(finalPath), ].join(' '); const r = run(cmd); ``` ### Technical Analysis The application constructs commands by concatenating strings and then passes the resulting command to `bash -lc`. Consequently, the shell interprets metacharacters contained in user-controlled arguments. The `--veo-model` and `--lang` values are inserted without shell quoting. Other ...[truncated 1612 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/generate.js:166

Finding

Unvalidated Identifiers Permit Output Path Traversal

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/tiktok_overlay_engine_v3.py:45

Finding

Incomplete FFmpeg Escaping Permits Filter-Graph Injection

Content

View full analysis

str: """Build ffmpeg drawtext filter chain with timed captions.""" segment = duration / len(captions) filters = [] # For AR we flip alignment; default LTR for EN align_x = "w/2" if lang == "AR" else "w/2" for i, caption in enumerate(captions): start = i * segment end = start + segment # Escape special chars for ffmpeg safe = (caption .replace("'", "\\'") .replace(":", "\\:") .replace(",", "\\,")) f = ( f"drawtext=text='{safe}'" f":fontsize={font_size}" f":fontcolor={text_color}" f":x=(w-text_w)/2" f":y=h*0.75" f":box=1:boxcolor={pill_color}:boxborderw=20" f":enable='between(t,{start:.2f},{end:.2f})'" f":alpha='if(lt(t-{start:.2f},0.3),(t-{start:.2f})/0.3,if(gt(t,{end:.2f}-0.3),(({end:.2f}-t)/0.3),1))'" ) filters.append(f) return ",".join(filters) ``` ```python drawtext = build_drawtext_filter( captions, duration, args.font_size, args.text_color, args.pill_color, args.lang ) if args.logo and Path(args.logo).exists(): filter_complex = ( f"[0:v]{drawtext}[captioned];" f"[1:v]scale=w*0.10:-1[logo];" f"[captioned][logo]overlay=W-w-20:20[out]" ) cmd = [ "ffmpeg", "-y", "-i", str(inp), "-i", args.logo, "-filter_complex", filter_complex, "-map", "[out]", "-map", "0:a?", "-c:v", "libx264", "-preset", "fast", "-crf", "20", "-c:a ...[truncated 2135 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/pipeline.py:2

Finding

Unpinned Dependencies Are Installed or Resolved at Runtime

Content

View full analysis

=3.10" # dependencies = ["moviepy>=2.0"] # /// ``` ```python def run_overlay(video, product, style, output, audio=None): t0 = time.time() print(f"[pipeline] ⏳ Step 3: Applying caption overlay ({style}) ...") cmd = [ "uv", "run", "--with", "moviepy", "--with", "pillow", OVERLAY_SCRIPT, "--video", video, "--product", product, "--style", style, "--output", output, ] if audio: cmd += ["--audio", audio] subprocess.run(cmd, check=True) ``` ```python # /// script # requires-python = ">=3.10" # dependencies = [ # "pillow>=10.0.0", # ] # /// ``` ### Technical Analysis The scripts permit broad dependency ranges such as `moviepy>=2.0` and `pillow>=10.0.0`. The overlay command additionally uses `uv run --with moviepy --with pillow` without exact versions or integrity hashes. As a result, package resolution may retrieve mutable third-party artifacts at execution time. The code ultimately executed can differ from the version reviewed during the audit. There is no lockfile or hash-based integrity control in the audited project. The pipeline also executes Python scripts from sibling Skill directories. Those external scripts are outside this project and were therefore not available for verification, further expanding the runtime trust boundary. ### Attack Path 1. The pipeline runs in an environment where the required dependency is not already available in a trusted cache. 2. `uv` resolves the unconstrained package name or broad version range against its configured package index. 3. A compromised package release, index, resolver configuration, or dependency chain s ...[truncated 648 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The file presents the skill as a fully automated end-to-end TikTok generation pipeline, but the detected behavior is materially narrower. This misrepresentation can cause operators to overtrust the skill, provide sensitive inputs or API keys under false assumptions, and run it in production contexts expecting controls or stages that do not actually exist.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

node scripts/generate.js \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

md

node scripts/generate.js \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

node scripts/generate.js \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

node scripts/generate.js \

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

node scripts/generate.js \

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises and orchestrates shell-capable behavior (node, uv, ffmpeg) and relies on environment secrets (GEMINI_API_KEY), but it does not declare an explicit tool/permission scope. This creates a trust and containment gap: a host may grant broader execution than reviewers expect, increasing the risk of unintended command execution or secret exposure if the skill or its dependencies are modified or abused.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The code sets lang: 'EN' as the default, so output language is implicitly forced to English unless the user knows to override it. This is a natural-language locale policy concern because the skill does not prompt for language choice or obtain opt-in before applying a specific language setting.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The helper runs commands through bash -lc, which turns later command construction into shell-interpreted strings rather than safe argument arrays. In this file, multiple command fragments include user-controlled values such as --veo-model, --segments, and file paths, and not all of them are safely escaped, so crafted input can lead to command injection and arbitrary code execution in the host environment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/pipeline.py (reported line 85)May include surrounding context.

python

"--duration", str(duration),
        "--ratio", ratio,
    ]
    result = subprocess.run(cmd, check=True)
    print(f"[pipeline] ✅ Runway done ({time.time()-t0:.1f}s)")
    return result.returncode == 0

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/pipeline.py (reported line 99)May include surrounding context.

python

t0 = time.time()
    print(f"[pipeline] ⏳ Step 1: Generating video via Veo ...")
    cmd = ["uv", "run", veo_script, "--image", image, "--prompt", prompt, "--output", output]
    result = subprocess.run(cmd)
    if result.returncode == 0:
        print(f"[pipeline] ✅ Veo done ({time.time()-t0:.1f}s)")
        return True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/pipeline.py (reported line 120)May include surrounding context.

python

]
    if audio:
        cmd += ["--audio", audio]
    subprocess.run(cmd, check=True)
    print(f"[pipeline] ✅ Overlay done → {output} ({time.time()-t0:.1f}s)")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tiktok_overlay_engine_v3.py (reported line 37)May include surrounding context.

python

def get_video_duration(path: Path) -> float:
    result = subprocess.run(
        ["ffprobe", "-v", "quiet", "-print_format", "json",
         "-show_format", path],
        capture_output=True, text=True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 88% confidence

Finding

Although ffmpeg is launched without shell=True, the command embeds user-controlled values such as captions, text color, pill color, and logo path into ffmpeg filter expressions. The escaping is incomplete for drawtext/filter syntax, so crafted input can break filter parsing or trigger unintended ffmpeg behavior, causing denial of service or unsafe processing in an automation pipeline that handles untrusted content.

Content

Scanner excerpt · scripts/tiktok_overlay_engine_v3.py (reported line 145)May include surrounding context.

python

]

    print(f"Running ffmpeg overlay...")
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"ERROR:\n{result.stderr}", file=sys.stderr)
        sys.exit(result.returncode)

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/generate.js:71