Security audit

Cinematic Story Video Gen

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed WeryAI video-generation helper, but it ships executable code with an unaudited dependency outside the package and can upload arbitrary local files when image paths are supplied.

Install only if you trust the package layout and WeryAI integration. Use public HTTPS image URLs by default; do not pass local paths unless you are comfortable with that exact file being uploaded to WeryAI. Run with a scoped WERYAI_API_KEY in an isolated environment, and prefer a version that bundles or pins the external error-formatting dependency inside the reviewed package.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/video_gen.js:203
Finding: Unrestricted Local File Read and Upload Through Image Parameters
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/video_gen.js:5
Finding: Execution of an Unverified Dependency Outside the Skill Package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims safety-relevant behavior that is not actually implemented, including default model handling and mandatory prompt expansion, while omitting mention of some real operational capabilities such as model lookup and status polling. This mismatch can cause operators or users to trust controls that do not exist, leading to unintended paid submissions, malformed requests, or unsafe handling of user inputs and local files.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
WERYAI_VIDEO_API.md`](references/WERYAI_VIDEO_API.md)** (CLI/API reference); **`scripts/video_gen.js`** is supplied by your **sync / publish** step (same as oth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
WERYAI_VIDEO_API.md`](references/WERYAI_VIDEO_API.md)** (CLI/API reference); **`scripts/video_gen.js`** is supplied by your **sync / publish** step (same as oth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
WERYAI_VIDEO_API.md`](references/WERYAI_VIDEO_API.md)** (CLI/API reference); **`scripts/video_gen.js`** is supplied by your **sync / publish** step (same as oth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
WERYAI_VIDEO_API.md`](references/WERYAI_VIDEO_API.md)** (CLI/API reference); **`scripts/video_gen.js`** is supplied by your **sync / publish** step (same as oth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
WERYAI_VIDEO_API.md`](references/WERYAI_VIDEO_API.md)** (CLI/API reference); **`scripts/video_gen.js`** is supplied by your **sync / publish** step (same as oth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
WERYAI_VIDEO_API.md`](references/WERYAI_VIDEO_API.md)** (CLI/API reference); **`scripts/video_gen.js`** is supplied by your **sync / publish** step (same as oth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
WERYAI_VIDEO_API.md`](references/WERYAI_VIDEO_API.md)** (CLI/API reference); **`scripts/video_gen.js`** is supplied by your **sync / publish** step (same as oth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
md
WERYAI_VIDEO_API.md`](references/WERYAI_VIDEO_API.md)** (CLI/API reference); **`scripts/video_gen.js`** is supplied by your **sync / publish** step (same as oth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
md
WERYAI_VIDEO_API.md`](references/WERYAI_VIDEO_API.md)** (CLI/API reference); **`scripts/video_gen.js`** is supplied by your **sync / publish** step (same as oth

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
*[`references/WERYAI_VIDEO_API.md`](references/WERYAI_VIDEO_API.md)** (next to `SKILL.md` under **`references/`**).

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares network and environment-variable requirements but does not constrain tool scope with explicit permissions or allowed-tools. In an agentic environment, that omission can permit broader-than-necessary execution and data egress paths, increasing the blast radius if the skill is misused or if downstream scripts behave unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The implicit trigger phrases are broad enough to match generic filmmaking or creative-writing prompts that are not clearly asking for this specific skill. This can cause unintended skill activation, leading the agent to route unrelated requests into video-generation behavior, which is a scope-control and authorization problem rather than direct code execution.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says 'Default: KLING_V3_0_PRO; draft: SEEDANCE_2_0', which implies the skill can expand briefs and submit using a default model when one is not provided. In code, submission fails if model is absent, and the error explicitly states there is 'no default model,' so the implemented behavior does not match the skill's advertised behavior.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
md
**Blocking until done** (only if the user asked to wait): `node {baseDir}/scripts/video_gen.js wait --json '…'` with the **same** JSON shape—see **[`references/WERYAI_VIDEO_API.md`](references/WERYAI_VIDEO_API.md)**. **This skill adds only model-specific filtering on top of that doc:** build JSON that satisfies **`## Model and API constraints`** here (e.g. **omit `resolution`** for **Kling V3**; **include `resolution`** for **Seedance 2.0**; **do not** send **`negative_prompt`** to **Seedance**). **Default rhythm:** after explicit confirmation, prefer **async `submit-*`** then **`status`**; use **`wait`** only when the user asked to block until completion—see the **Agent UX** section in the API file for polling guidance. ## Prompt expansion (mandatory)

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The doc comment states the script 'only reads the above key,' presenting environment-variable usage as tightly constrained. While the code does indeed read that same key, it reads it in several command paths and uses it for model listing, uploads, generation, and status requests; the comment is framed as operational intent but is incomplete rather than fully descriptive of behavior around networked uses of the key.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.