Security audit

product-demo

Security checks for vulnerabilities and agentic risk

Overview

The skill’s main purpose is coherent, but its missing-dependency recovery path recommends broad unpinned global skill installation across agents, which is more authority than this task needs.

Install only the required ofox-video-core dependency from a trusted, pinned source and avoid wildcard global installs such as --skill '*' --agent '*' --global --yes. Before using the skill, inspect the separate core skill because this package delegates API handling and safety behavior to it. Also remove secrets, customer data, live tokens, faces, or other private information from screenshots before uploading them to Ofox, and approve paid jobs only after reviewing the dry-run cost table.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:565
Finding: Unpinned and Overbroad Global Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 565–568 **Vulnerability Type**: Unsafe third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```text - **The probe printed nothing** — `ofox-video-core` really is absent, and the fix belongs to whichever installer the user already has: `npx ofox-skills` (this repo's own) or the underlying `npx skills add ofoxai/skills --skill '*' --agent '*' --global --yes` for skills.sh; on LobeHub or ClawHub, install `ofox-video-core` from the same publisher. ``` ### Technical Analysis The documented recovery procedure invokes npm-delivered command-line packages through `npx` without pinning an audited package version or verifying package integrity. An unpinned `npx` invocation can retrieve and execute a newer package release whose contents differ from those reviewed. The second command further uses `--skill '*'`, `--agent '*'`, `--global`, and `--yes`. This installs every available skill from the publisher for all supported agents at global scope, suppressing interactive confirmation, even though the documented feature only requires `ofox-video-core`. This violates least-dependency principles and unnecessarily expands the trusted supply chain and installed capability set. The commands are presented as manual recovery instructions rather than silently executed code. Exploitation therefore depends on an Agent or user following the instructions when the core dependency is absent. ### Attack Path 1. The required `ofox-video-core` dependency is missing. 2. An Agent or user follows the documented fallback installation procedure. 3. `npx` resolves and downloads the current, unpinned installer package. 4. npm package lifecycle or installer code executes with the invoking user's privileges. 5. If the fetched package or publisher distribution has been compromised, attacker-controlled code executes locally. 6. The wildcard global command additionally installs all publisher-provided ...[truncated 1010 chars]
Remediation: ## Remediation Suggestions 1. Pin the installer to a reviewed version rather than resolving the latest release implicitly, for example by using an exact package version. 2. Verify the downloaded package using a trusted lockfile, registry integrity metadata, signature, or published checksum before execution. 3. Install only the required `ofox-video-core` skill instead of using `--skill '*'`. 4. Limit installation to the specific Agent that needs the dependency instead of using `--agent '*'`. 5. Prefer a project-local or user-scoped installation over `--global`. 6. Remove `--yes` so users can review the package source, version, scope, and requested changes before installation. 7. Require explicit user approval before initiating any package installation. 8. Prefer a verified local package, vendored audited dependency, or signed official release artifact where available. 9. Document the exact trusted publisher identity and minimum compatible version, then fail safely if verification cannot be completed.

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Ae1

High

Category: analysis-evasion
Content: one this `SKILL.md` sits in. From anywhere else nothing resolves — use the
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: one this `SKILL.md` sits in. From anywhere else nothing resolves — use the
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Session Persistence

Medium

Category: Rogue Agent
Content: --- name: product-demo description: Requires OFOX_API_KEY — create one at https://app.ofox.ai, plus two real screenshots of one interface in two states. Animates the transition between them as one video — both go into a single Ofox video job, and the model cross-fades the values that changed while the rest of the layout holds. Use when a user wants a short software demo animation out of captures they already have, e.g. "turn these two screenshots into a demo clip", "show the dashboard going from the free plan to the paid one", "animate this settings change for the docs", or "make a clip of the counter going from 3 to 25". Do not use for a pair that is not a user interface (see keyframe-animation), for a screen recording (record it instead), or when only one screenshot exists. license: MIT version: "1.0.1" homepage: https://github.com/ofoxai/skills/tree/main/skills/product-demo
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

No suspicious patterns detected.