T09 · Insecure Skill Coding Practices
Error
- Location
scripts/video_remix.py:490- Finding
Environment-Controlled Temporary Directory Can Cause Arbitrary Recursive Deletion
- Content
View full analysis
- Remediation
View remediation
Security audit
video-remix
Security checks for vulnerabilities and agentic risk
Overview
This skill is a real video-remix workflow, but it uses powerful setup, browser, network sharing, external AI, and cleanup behavior that needs human review before installation.
Install only if you are comfortable with a skill that can install system packages, use a logged-in browser profile for Gemini, download videos, send transcript-derived text to AI/TTS services, and serve generated files on your local network. Run it in an isolated workspace, avoid sudo-driven setup from the skill itself, keep VR_TEMP_DIR pointed at a dedicated disposable folder, disable or restrict LAN HTTP sharing, and do not process private or copyrighted material unless you accept the external-service disclosures.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/gemini_first_remix.py:361- Finding
Unauthenticated HTTP Server Exposes the Entire Output Directory on All Network Interfaces
- Content
View full analysis
int: """启动 HTTP 服务器""" import threading # 确保使用绝对路径 output_dir = output_dir.absolute() output_dir.mkdir(parents=True, exist_ok=True) def run_server(): subprocess.run( [sys.executable, "-m", "http.server", str(port)], cwd=str(output_dir), capture_output=False ) thread = threading.Thread(target=run_server, daemon=True) thread.start() return port ``` ```python lan_ip = get_lan_ip() port = 8888 start_http_server(OUTPUT_DIR, port) print(f"\n🌐 局域网访问地址:") print(f" http://{lan_ip}:{port}/{final_output.name}") print(f" http://{lan_ip}:{port}/ (浏览所有文件)") ``` ### Technical Analysis Python's `http.server` binds to all available interfaces by default when no `--bind` argument is supplied. Its default request handler also permits directory listings. Consequently, the server exposes the complete contents of `OUTPUT_DIR`, not only the generated final video. No authentication, authorization, transport encryption, random access token, or client restriction is applied. LAN sharing is an explicitly declared feature, so starting a network server is related to the Skill's purpose. However, unrestricted directory browsing and automatic all-interface binding exceed the minimum privilege needed to share one generated file. ### Attack Path 1. A user completes the remix pipeline, which automatically starts the server on TCP port 8888. 2. Another host with network reachability discovers the service through port scanning, logs, shared terminal output, or predictable addressing. 3. The host requests `http://target:8888/`. 4. The default directory listing reveals all fil ...[truncated 926 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
modules/script_gen.py:248- Finding
Custom LLM Endpoint Can Receive Video Content and the OpenAI API Credential
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:4- Finding
Unbounded and Unverified Runtime Dependencies Create Supply-Chain Risk
- Content
View full analysis
=2024.0.0 faster-whisper>=1.0.0 edge-tts>=6.1.0 openai>=1.0.0 requests>=2.28.0 ``` ```bash pip3 show edge-tts >/dev/null 2>&1 || pip3 install edge-tts pip3 show yt-dlp >/dev/null 2>&1 || pip3 install yt-dlp ``` ### Technical Analysis The requirements specify only minimum versions and no upper bounds, hashes, lockfile, or reviewed package index. The setup instructions also install packages directly at runtime without selecting an exact version. As a result, two installations performed at different times may receive materially different code. Any future release satisfying the broad constraints is trusted automatically. Package installation can execute package build or installation logic, and installed libraries or command-line tools execute during normal Skill operation. The package names observed in the project are consistent with the declared functionality; no dependency-confusion or typosquatting package was confirmed. The finding concerns insufficient supply-chain controls rather than a demonstrated malicious package. ### Attack Path 1. A future upstream release satisfying a `>=` constraint becomes compromised, malicious, or incompatibly modified. 2. A user follows the setup instructions or installs from `requirements.txt`. 3. The package manager selects the newly published version. 4. Package-controlled code executes during installation, import, or command invocation. 5. The malicious dependency acts with the filesystem, environment, and network privileges of the user running the Skill. This exploitation path depends on upstream compromise, malicious publication, package-index compromise, or unsafe index configuration. ### Impact Assessment A compromised dependency could potentially access: - Files ...[truncated 391 chars]- Remediation
View remediation
faster-whisper== edge-tts== openai== requests== ``` 2. Generate a lockfile including transitive dependencies. 3. Use hash verification, such as `pip install --require-hashes -r requirements.txt`. 4. Install dependencies in an isolated virtual environment rather than the global Python environment. 5. Separate installation from Skill execution; the Skill should fail safely with clear setup guidance instead of automatically installing packages. 6. Use a trusted package index explicitly and prevent unreviewed extra indexes. 7. Add automated dependency vulnerability scanning and a controlled update process. 8. Review new dependency versions before updating pins, especially packages that perform networking, media parsing, model loading, or command execution. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (68)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The declared description promises a broader end-to-end YouTube processing assistant, including Gemini-based analysis, clipping, hard subtitle synthesis, and LAN HTTP sharing. The actual code chunk is only an init.py that re-exports modules for download, transcription, analysis, script generation, TTS, and merging. Some declared functions are partially aligned with these exports, but several notable promised capabilities are not evidenced in the supplied code, especially LAN HTTP sharing and explicit hard subtitle composition. Because the visible code represents a narrower and somewhat different set of capabilities than the description, this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code matches only the downloading portion of the description. It fetches video metadata, downloads a video file, optionally downloads audio separately, supports format/quality selection, uses an HTTP/HTTPS proxy if present, and cleans up local downloaded files. There is no evidence of Gemini-based analysis, clipping, dubbing, subtitle burning, or local HTTP sharing in this code chunk. Because the declared description presents a much broader multifunction video-processing assistant than what this code actually does, the description is not an accurate representation of the supplied code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a broad YouTube-processing assistant with AI analysis, downloading, clipping, dubbing, hard subtitle embedding, and LAN HTTP sharing. The supplied code only covers one narrow media-processing component: using FFmpeg/ffprobe to merge video with new audio, cut timed segments, concatenate clips, replace/add audio, and extract audio. While this partially aligns with dubbing and some clipping-related processing, the primary declared capabilities around YouTube, Gemini analysis, subtitle hardcoding, and HTTP sharing are absent from this code chunk. Therefore the description does not accurately represent what this specific code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The declared description and the code overlap substantially on video download, transcription/analysis, script generation, dubbing, and final video merging. However, there are material discrepancies. First, the description specifically claims 'Gemini intelligent analysis', but the code configures ScriptGenerator with provider='openai' and an OPENAI_API_KEY, so the implemented LLM integration does not match that declared provider. Second, the description claims hard subtitle composition and LAN HTTP sharing, but this code chunk contains no subtitle burn-in/subtitle rendering logic and no local network HTTP serving/sharing functionality. Third, the code also supports local file input, which is broader than a pure YouTube assistant. These are meaningful behavior-description mismatches, so the description does not accurately represent this code chunk.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python 请只输出配音文案，不要其他说明：""" return prompt def _call_llm(self, prompt: str) -> str: """Call LLM API to generate script"""
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 93% confidence
- Finding
When no LLM provider is configured, the fallback returns a slice of the prompt segment after the '原始内容' marker, which can echo user-supplied source text and portions of prompt scaffolding into output unexpectedly. This can disclose raw transcription/content that may have been expected to be transformed rather than reproduced, increasing privacy and copyright exposure in this video-processing context.
- Content
python else: # Fallback: return simplified original text print("⚠️ No LLM configured, using original text") return prompt.split("【原始内容】")[-1].strip()[:100] def _call_openai(self, prompt: str) -> str: """Call OpenAI or compatible API"""
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill instructs use of shell, network, environment variables, and file read/write, but does not declare any tool scope or allowed-tools restrictions. That means a host agent may grant broader capabilities than users expect, increasing the chance of unintended command execution, filesystem modification, network access, and data exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly instructs downloading content and exposing outputs over a LAN HTTP server, but does not require clear user confirmation or provide meaningful privacy warnings. This can expose copyrighted or sensitive media to anyone on the local network and may unintentionally leak generated files or directory listings.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list is broad enough to activate on many generic video-related requests, which can cause the agent to invoke a highly privileged workflow unexpectedly. In this skill, unexpected activation is more dangerous because the workflow includes browser automation, package installation, downloads, file writes, and HTTP serving.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions explicitly require the generated script to be written in Chinese, and the skill also defaults to Chinese TTS voices, but there is no opt-in or user choice for language. Under the stated policy, forcing a specific language/locale without user selection is a natural-language policy violation.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The skill directs execution of sudo apt update/install as part of normal operation. Embedding privileged package-management commands in a skill materially increases risk of host modification, unreviewed dependency installation, and abuse if the skill is triggered unexpectedly or if package sources/dependencies are compromised.
- Content
md # 0.3 平台依赖（Ubuntu/Debian） if command -v apt >/dev/null 2>&1; then sudo apt update -y sudo apt install -y ffmpeg yt-dlp libass-dev fi
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The second sudo invocation continues the same privileged installation flow and compounds the risk by performing package installation with elevated rights. In the context of a skill that also automates network and shell actions, this creates a broad host-compromise surface if misused or triggered without careful review.
- Content
md # 0.3 平台依赖（Ubuntu/Debian） if command -v apt >/dev/null 2>&1; then sudo apt update -y sudo apt install -y ffmpeg yt-dlp libass-dev fi # 0.4 Python 依赖（幂等安装）
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The analyzer hard-codes keyword lists and scoring terms specifically for Chinese and English content, which creates a built-in locale preference in the skill behavior. Because the file does not provide any user opt-in, configuration, or documented restriction to those languages, this can violate language/locale policy expectations.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The downloader implicitly reads HTTP_PROXY/HTTPS_PROXY from the process environment, causing network traffic and requested video URLs to be routed through infrastructure the user may not expect. In an agent or hosted environment, this can leak sensitive request metadata, enable traffic inspection, or change network reachability in ways not disclosed by the skill interface.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.append(url) print(f"📥 Downloading video: {title}") result = subprocess.run( cmd, capture_output=True, text=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.extend(["--proxy", self.proxy]) cmd.append(url) result = subprocess.run( cmd, capture_output=True, text=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.extend(["--proxy", self.proxy]) cmd.append(url) result = subprocess.run( cmd, capture_output=True, text=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.extend(["--proxy", self.proxy]) cmd.append(url) result = subprocess.run( cmd, capture_output=True, text=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python cmd.extend(["--proxy", self.proxy]) cmd.append(url) result = subprocess.run( cmd, capture_output=True, text=True,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The cleanup method unlinks all .mp4, .m4a, and .info.json files in the output directory, which is a destructive file-deletion operation. There is no confirmation prompt, print/log message, or warning in nearby documentation/comments that this method will delete user-downloaded content.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python str(output_path) ]) result = subprocess.run( cmd, capture_output=True, text=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python str(output_path) ]) result = subprocess.run( cmd, capture_output=True, text=True,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code sends segment text, summaries, keywords, and optionally full transcription context to external LLM providers without any visible consent gate, redaction, or disclosure control. If the input contains private, copyrighted, or sensitive content, this can leak user data to third-party services and may violate user expectations or policy requirements.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Natural-language instructions hardcode Chinese output ("语言：中文"), while the class exposes a language parameter that is not honored in prompt construction. This creates a language policy issue because the skill imposes a specific language without offering user choice at generation time.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
The local-model path performs an HTTP POST to a configurable base_url, which can transmit prompt contents off-host if the URL is changed from localhost to a remote service. Because the payload includes user-derived text and there is no allowlist, TLS enforcement, or warning, this creates a data exfiltration/privacy risk similar to other remote LLM calls.
- Content
python "stream": False } response = requests.post(url, json=payload, timeout=60) response.raise_for_status() data = response.json()
Static analysis
No suspicious patterns detected.