Security audit

Video Summarizer（视频摘录+Notion/Obsidian知识库存档）

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed video summarizer that uses cloud AI, cloud image storage, optional Notion publishing, and local Obsidian writes, so users should configure it carefully but the behavior matches its purpose.

Install only if you are comfortable sending video transcripts, metadata, audio when Groq is configured, screenshots, and cover images to the services you configure. Use dedicated least-privilege API keys, prefer a private dedicated OSS bucket, avoid sensitive or confidential videos, and remove the Bilibili cookie file when you no longer need authenticated subtitle access.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Tainted flow: 'share_url' from requests.get (line 106, network input) → requests.get (network output)

Medium

Category: Data Flow
Content: raise ValueError("未找到有效的分享链接") share_url = urls[0] share_response = requests.get(share_url, headers=HEADERS) video_id = share_response.url.split("?")[0].strip("/").split("/")[-1] share_url = f'https://www.iesdouyin.com/share/video/{video_id}'
Confidence: 88% confidence
Finding: The script extracts the first URL from arbitrary share text and fetches it without validating the hostname or allowed scheme beyond a regex match. An attacker could supply a crafted link that causes server-side requests to unintended external destinations, enabling SSRF-like behavior or internal network probing when this tool runs in a trusted environment.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares no explicit permissions even though its documented behavior clearly requires access to environment variables, local files, network services, and shell tools. This mismatch weakens user review and platform enforcement because a consumer may grant trust without understanding the actual capability scope, especially since the skill handles sensitive credentials and writes into local knowledge stores.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The documentation states that cover images are automatically uploaded to OSS, which introduces external data transfer beyond the skill's stated purpose of generating summaries for Obsidian and Notion. Even if the image is only a thumbnail, automatic third-party upload can expose user activity and content metadata without clear disclosure or consent.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script transmits full subtitle transcripts and video metadata to a configurable external LLM endpoint via `LLMClient.from_env()` and `analyze_simple()`. This is a real data-exposure issue because the destination can be any OpenAI-compatible service, and users are not given a clear trust boundary, consent prompt, or minimization controls before potentially sensitive content leaves the local environment.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script is explicitly designed to obtain and persist Bilibili account cookies, which grants authenticated session access. In the stated skill context of video summarization and publishing notes to Obsidian/Notion, collecting login cookies expands capabilities beyond simple summarization and introduces credential-handling risk if the cookies are later reused, exfiltrated, or mishandled.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Invoking an external tool to perform interactive login and capture privileged session cookies gives the skill the ability to act as the user on Bilibili. That is sensitive functionality, and in this skill’s declared context it is not clearly justified, making it more dangerous because it introduces account-access capability unrelated to local summarization/output workflows.

Description-Behavior Mismatch

Medium

Confidence: 81% confidence
Finding: The script uploads local audio content to Groq's remote transcription API, creating an external data disclosure path. In the skill context, remote transcription can be functionally related to summarization, but it becomes risky because the transfer is automatic and not clearly constrained or disclosed to the user at the point of use.

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The skill advertises summarization into Obsidian and Notion, but this script also uploads screenshots and thumbnails to Alibaba Cloud OSS, expanding data egress beyond the stated destinations. That mismatch matters because screenshots and cover images can contain sensitive visual content, and users may not expect a third-party cloud bucket to receive them.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The code reads OSS credentials from environment files and performs standalone cloud-storage operations that are not inherent to generating a summary. This increases the attack surface and the chance of unintended exfiltration if the skill is run in an environment where users do not realize their local media will be sent to an external bucket.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script uploads screenshots and cover images to OSS/public URLs, which is a real data-exfiltration capability beyond the stated Obsidian + Notion scope. Even if intended for image hosting, it transmits derived content from user videos to a third-party service and may expose private or copyrighted material through public links.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README states that pushing to an Obsidian vault is enabled by default, but it does not clearly warn users that running the script will create or modify local files in a user-specified knowledge base. In a skill that processes arbitrary URLs and writes generated content automatically, this can lead to unexpected filesystem changes, accidental overwrite/clutter, or disclosure of sensitive local notes context if users do not realize local persistence is the default behavior.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README advertises automatic Notion push as an option, but does not clearly warn that video-derived content, metadata, screenshots, and AI-generated summaries may be transmitted to third-party cloud services. Because this skill handles potentially sensitive user-selected content and integrates with external APIs, missing privacy and data-transfer disclosure increases the risk of unintentional exfiltration to SaaS platforms.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: Automatic upload of cover images to OSS is a privacy-relevant network action, but the documentation provides no warning about transmission, retention, or who can access the uploaded asset. This can lead to unintended disclosure of viewed content, associated metadata, or account-linked storage usage.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Subtitle text and metadata are sent to an external LLM service without any in-script privacy warning, confirmation prompt, or retention notice. This is dangerous because transcripts may contain private, copyrighted, or confidential material, and the configurable base URL means the data could be routed to an untrusted third-party endpoint without the user's awareness.

Missing User Warnings

Low

Confidence: 86% confidence
Finding: The script persists `ai_result.json` and generated Markdown summaries to disk automatically, but does not provide an explicit warning that analysis artifacts will be stored locally. This can leak sensitive transcript-derived content to shared machines, synced folders, backups, or downstream integrations such as Obsidian/Notion, especially when users assume processing is ephemeral.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code uploads extracted audio content to Groq for transcription, but there is no explicit runtime consent, warning, or policy gate before sending potentially sensitive user media off-device. In a summarization skill handling personal or proprietary videos, this can create privacy and data-governance exposure even if the transmission is functionally intended.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The script uploads local markdown content, extracted metadata, URLs, author names, cover URLs, and parsed note content to Notion, but the execution path provides no explicit consent prompt or strong user-facing warning at push time about what data leaves the local machine. In this skill context, the file may contain private notes or sensitive source metadata, so silent cloud transmission increases privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: Audio files are transmitted to a remote API without an explicit user-facing warning or consent checkpoint in this script. Because audio may contain sensitive speech, personal data, or copyrighted material, silent cloud upload increases privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script sends screenshots and thumbnail data to OSS and requests public URLs without a clear user-facing warning at execution time. This creates an undisclosed outbound data flow that may surprise users and expose media-derived content externally.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: When enabled, the script reads Notion credentials and transmits summary content to Notion, but the code provides limited disclosure about what exact content is sent and how credentials are sourced. Because this is remote transmission of generated content using sensitive API keys, lack of explicit notice and consent granularity is a genuine security/privacy issue.

External Transmission

Medium

Category: Data Exfiltration
Content: timeout = self.timeout_base * (attempt + 1) print(f" 尝试 {attempt + 1}/{self.max_retries} (超时：{timeout}s)...") response = requests.post( endpoint, headers=headers, json=body, timeout=timeout, )
Confidence: 83% confidence
Finding: The code sends prompts and message content to a remote endpoint defined by LLM_BASE_URL, which is an external data transmission boundary. In a video summarizer context this is expected behavior, but it is still security-relevant because sensitive transcript, note, or user content could be transmitted to an untrusted or misconfigured third-party endpoint if the base URL is attacker-controlled or insufficiently constrained.

External Transmission

Medium

Category: Data Exfiltration
Content: print(" 🌐 使用 Groq API 转录...") url = "https://api.groq.com/openai/v1/audio/transcriptions" headers = {"Authorization": f"Bearer {GROQ_API_KEY}"} try:
Confidence: 83% confidence
Finding: The code communicates with an external Groq endpoint and uploads the supplied audio file for processing. External transmission is expected for cloud transcription, but in this skill context it is still security-relevant because local media content leaves the host and may contain sensitive information.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.