Security audit

拟人动物化妆变身视频

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended for WeryAI makeup-video generation, but its bundled helper is a broader generic video-generation client that uses an API key and remote endpoints beyond the makeup-specific workflow.

Install only if you are comfortable giving this skill access to a WeryAI API key and sending prompts or image URLs to WeryAI. Review usage carefully because the bundled script can generate general videos and list models, not only makeup transformation clips.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a narrowly scoped makeup-transformation generator, but the implementation behavior reportedly supports broader generic video generation, remote model enumeration, job polling, and use of external credentials across multiple endpoints. That mismatch weakens user trust boundaries and can conceal a broader operational surface than expected, making it easier to misuse the skill for unintended content generation or unnoticed data transfer.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
**依赖**：本目录 `scripts/video_gen.js` + 运行环境需设置 `WERYAI_API_KEY` + Node.js 18+。不依赖其他 Cursor 技能。

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill requires environment access to WERYAI_API_KEY and network access to remote video-generation endpoints, but it does not declare any tool scope such as permissions or allowed-tools. This creates an undeclared capability gap: users and hosting platforms cannot clearly see or constrain that the skill will access secrets and make outbound requests, increasing the risk of unintended secret exposure or unauthorized external communication.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The implementation materially exceeds the advertised scope of the skill. Instead of enforcing a makeup-transformation use case, it exposes a generic text/image/multi-image video generation client, enabling arbitrary prompts and broader model use than users or reviewers would expect. In a skill ecosystem, this scope mismatch is dangerous because it can bypass trust decisions, policy review, or access approvals that were granted for a narrower purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code file’s primary natural-language documentation and CLI guidance are written in Chinese, and there is no indication that users may select another language or locale. That creates a language/locale policy concern because the skill effectively assumes a specific language without opt-in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The model-listing capability adds an unnecessary discovery surface unrelated to the stated purpose of generating makeup transformation videos. While not directly exploitable like code execution, it exposes broader service capabilities and can facilitate misuse of the skill as a generic reconnaissance or pivot tool against the backing API. In this context, the danger comes from unnecessary privilege and feature exposure.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/video_gen.js:22