视频提取文字

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:53 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward local video transcription helper, with ordinary supply-chain and overwrite-race cautions but no evidence of hidden, deceptive, destructive, or unrelated behavior.

Install only if you are comfortable letting the skill run ffmpeg/ffprobe, uv, and Whisper on video files you choose. For tighter security, use a pinned or preinstalled Whisper environment and avoid shared writable output directories when relying on no-overwrite behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/video_transcript_txt.py:174

Finding

Unpinned Third-Party Package Is Resolved and Executed at Runtime

Content

View full analysis

Vulnerability Details

File Location: scripts/video_transcript_txt.py:174-180; documented in SKILL.md:66
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

python

command = [
    "uv",
    "run",
    "--with",
    "openai-whisper",
    "whisper",
    str(video),

The corresponding documented command is:

bash

uv run --with openai-whisper whisper

Technical Analysis

The script asks uv to resolve and execute openai-whisper without specifying an exact version, lockfile, package hash, or trusted preinstalled environment. Consequently, the code executed during transcription may differ from the dependency version evaluated during this audit.

Runtime package resolution exposes the application to supply-chain risks, including a compromised future release, compromised package repository account, malicious transitive dependency, or unexpected incompatible update. The use of a list-form subprocess invocation prevents shell metacharacter injection, but it does not mitigate package-resolution risk.

Attack Path

1. An attacker compromises an upstream package release, maintainer account, distribution channel, or transitive dependency used by openai-whisper.
2. A user invokes the transcription skill.
3. uv run --with openai-whisper resolves the currently available uncontrolled dependency set.
4. The compromised package code is installed or selected and executed locally.
5. Malicious package code runs with the permissions of the user operating the skill.

Impact Assessment

Successful exploitation could execute arbitrary code with the invoking user's privileges. The compromised dependency could access the supplied video, process environment, files readable or writable by that user, network resources available to the process, and the configured model cache. No privilege-escalation mechanism is present in the audited code, so the impact is bounded by the inv ...[truncated 37 chars]

Remediation

View remediation

Remediation Suggestions

• Pin openai-whisper to a reviewed exact version rather than resolving an unconstrained release.
• Commit and enforce a dependency lockfile that also fixes transitive dependency versions.
• Use package hashes or signature verification where supported.
• Prefer a dedicated, pre-provisioned virtual environment containing audited dependencies, and invoke its fixed Whisper executable without runtime dependency installation.
• Configure uv to use only approved package indexes and prevent fallback to untrusted sources.
• Add automated dependency scanning and controlled update review before changing pinned versions.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/video_transcript_txt.py:89

Finding

No-Overwrite Protection Is Vulnerable to a Time-of-Check/Time-of-Use Race

Content

View full analysis

Vulnerability Details

File Location: scripts/video_transcript_txt.py:89-90 and scripts/video_transcript_txt.py:218
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

python

if output.exists() and not force:
    raise RuntimeError(f"输出已存在；如需覆盖请明确传入 --force：{output}")

The destination is subsequently published using:

python

os.replace(temporary_output, output)

Technical Analysis

The script checks whether the output exists before transcription begins. It later calls os.replace(), which atomically replaces an existing destination. There may be a significant delay between these operations while Whisper processes the video.

If another process creates the destination after validation but before os.replace(), the newly created file is overwritten even when the user did not supply --force. This is a time-of-check/time-of-use race and violates the documented no-overwrite behavior.

The temporary file is safely created with tempfile.mkstemp() in the output directory, so predictable temporary-file creation is not the issue. The flaw is specifically the unconditional replacement of the final destination after a non-atomic existence check.

Attack Path

1. The user starts transcription without --force.
2. The output path does not exist when validate_paths() performs its check.
3. While transcription is running, another user or process with write access to the output directory creates a file at the destination path.
4. The script completes transcription and invokes os.replace(temporary_output, output).
5. The intervening destination file is silently replaced despite the absence of overwrite authorization.

Impact Assessment

Exploitation can cause loss or replacement of a file created at the intended output path during processing. The affected scope is limited to a destination path that the invoking user can replace. The source video is not direct ...[truncated 194 chars]

Remediation

View remediation

Remediation Suggestions

• When --force is false, publish the completed file with an atomic no-replace operation rather than os.replace().
• On platforms without a direct no-replace rename primitive, create the destination using exclusive creation semantics and fail if it already exists.
• Keep os.replace() only for the explicitly authorized --force path.
• Ensure cleanup removes the temporary output if no-replace publication fails.
• Add a regression test that creates the destination after validation but before publication and verifies that the script reports an error without modifying the destination.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly instructs use of shell commands and file read/write behavior, but it does not declare any tool scope such as permissions or allowed-tools. This creates a mismatch between documented behavior and enforceable constraints, increasing the risk that an agent executes filesystem or shell operations more broadly than intended, especially across arbitrary absolute paths supplied by the user.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction states that if the user does not specify a language, the skill defaults to Chinese (zh). This is a language/locale policy constraint without user opt-in, and the file does not indicate that the user is offered a language choice before applying the default.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_transcript_txt.py (reported line 22)May include surrounding context.

python

def run_checked(command: list[str], *, capture: bool = False) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        command,
        check=True,
        text=True,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill can transcribe '一个或多个本地视频' and '批量生成带时间戳 TXT', implying multi-file or batch handling. However, the CLI defines exactly one positional argument video and the rest of the flow processes only that single file, with no loop or batch input support.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains a natural-language locale policy issue because --language is hard-coded to default to zh, which forces a specific language behavior unless the user overrides it. The file does not present this as an explicit opt-in choice, and the surrounding user-facing messages are also Chinese, reinforcing a fixed locale assumption.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This JSON file is a manifest-like test prompt file, so vague-trigger checks apply. The prompt '这 5 个视频都转文字，尽量快一点' relies on an unspecified set of videos and broad conversational wording, making activation scope unclear and increasing the chance of unintended matching without explicit file references or negative constraints.

Content

No source excerpt is available for this finding.