Trust Assessment
video-agent received a trust score of 58/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 4 findings: 0 critical, 2 high, 2 medium, and 0 low severity. Key findings include Suspicious import: urllib.request, Arbitrary File Write via Directory Traversal.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings4
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Write via Directory Traversal The `download_video` function in both `scripts/generate.py` and `scripts/status.py` constructs a file path using a user-provided `out_dir` argument. This argument is taken directly from command-line input (`args.out_dir`) and is not sanitized or validated. A malicious user can specify an `out_dir` containing directory traversal sequences (e.g., `../`) or an absolute path (e.g., `/etc`). This allows the skill to write files to arbitrary locations on the filesystem, potentially overwriting critical system files, writing to sensitive directories outside the skill's intended scope, or filling up disk space in unintended locations. Validate the `out_dir` argument to ensure it is a relative path and does not contain directory traversal sequences (`..`), or resolve it against a known safe base directory and verify that the final path remains strictly within that base directory. For example, ensure `Path(out_dir).resolve()` is a child of `Path(skill_sandbox_root).resolve()`. A simpler and more robust fix would be to always write to a fixed, non-user-controlled subdirectory within the skill's execution environment, or to a temporary directory managed by the system. | LLM | scripts/generate.py:70 | |
| HIGH | Arbitrary File Write via Directory Traversal The `download_video` function in both `scripts/generate.py` and `scripts/status.py` constructs a file path using a user-provided `out_dir` argument. This argument is taken directly from command-line input (`args.out_dir`) and is not sanitized or validated. A malicious user can specify an `out_dir` containing directory traversal sequences (e.g., `../`) or an absolute path (e.g., `/etc`). This allows the skill to write files to arbitrary locations on the filesystem, potentially overwriting critical system files, writing to sensitive directories outside the skill's intended scope, or filling up disk space in unintended locations. Validate the `out_dir` argument to ensure it is a relative path and does not contain directory traversal sequences (`..`), or resolve it against a known safe base directory and verify that the final path remains strictly within that base directory. For example, ensure `Path(out_dir).resolve()` is a child of `Path(skill_sandbox_root).resolve()`. A simpler and more robust fix would be to always write to a fixed, non-user-controlled subdirectory within the skill's execution environment, or to a temporary directory managed by the system. | LLM | scripts/status.py:40 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/michaelwang11394/video-agent/scripts/generate.py:8 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/michaelwang11394/video-agent/scripts/status.py:8 |
Scan History
Embed Code
[](https://skillshield.io/report/846183f36d37f541)
Powered by SkillShield