Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to be a straightforward local ffmpeg media compressor with expected file-writing behavior and no evidence of hidden network access or persistence.
Install this only if you want local media compression and are comfortable with ffmpeg. Review any sudo package-install command yourself, use preview or test files before batch runs, and pick output paths that will not overwrite files you care about. Expect some command-line output to be in Chinese.
A second material description/behavior inconsistency is present: the skill is presented as general-purpose media conversion, while the analyzer reports narrower or different actual functionality. Such discrepancies are dangerous because operators may authorize the skill under false assumptions, enabling unintended file transformations or data duplication.
A second material description/behavior inconsistency is present: the skill is presented as general-purpose media conversion, while the analyzer reports narrower or different actual functionality. Such discrepancies are dangerous because operators may authorize the skill under false assumptions, enabling unintended file transformations or data duplication.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
## Prerequisites
**ffmpeg must be installed:**
- Ubuntu/Debian: `sudo apt update && sudo apt install ffmpeg`
- macOS: `brew install ffmpeg`
- Windows: Download from https://ffmpeg.org/download.html and add to PATH
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
## Prerequisites
**ffmpeg must be installed:**
- Ubuntu/Debian: `sudo apt update && sudo apt install ffmpeg`
- macOS: `brew install ffmpeg`
- Windows: Download from https://ffmpeg.org/download.html and add to PATH
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Ubuntu/Debian
sudo apt install ffmpeg
# macOS
brew install ffmpeg
The skill documents commands that require shell execution and imply file writes, but it does not declare any explicit tool scope or permissions. In an agent setting, this weakens policy boundaries and can lead to broader-than-expected command execution or filesystem modification when the skill is invoked.
The skill promotes compression and batch processing without a prominent warning that compression is typically lossy and may permanently reduce quality or overwrite expected outputs. In practice, this can cause irreversible data degradation at scale, especially when users run batch commands or assume safe defaults.
The documentation instructs users to run privileged installation commands with sudo. While common for package installation, embedding root-level commands in a skill increases risk because users may execute them reflexively in environments where they do not fully trust the skill or understand package/source implications.
## Prerequisites
**ffmpeg must be installed:**
- Ubuntu/Debian: `sudo apt update && sudo apt install ffmpeg`
- macOS: `brew install ffmpeg`
- Windows: Download from https://ffmpeg.org/download.html and add to PATH
The batch-processing example shows status messages entirely in Chinese, which implies the skill may force or assume a specific language for user-facing output. There is no indication elsewhere that the skill is region-specific or that users can choose their preferred language, so this conflicts with the policy against forcing a language without opt-in.
The troubleshooting section again recommends sudo-based package installation, normalizing privileged execution inside the skill documentation. Repetition increases the chance that users treat root commands as routine and execute them without adequate review.
Install ffmpeg first:
# Ubuntu/Debian
sudo apt update && sudo apt install ffmpeg
# macOS
brew install ffmpeg
The script emits user-facing status, error, and help text in Chinese, beginning with the ffmpeg installation guidance here and continuing throughout the CLI. This enforces a specific language for all users without opt-in or documentation that the tool is intended only for a Chinese-speaking or region-specific context.
This Python file contains user-facing output and command-line descriptions entirely in Chinese, starting with the ffmpeg installation messages and continuing throughout the script. The file does not offer a user opt-in or alternative locale, which creates a natural-language locale policy violation under the requirement to avoid forcing a specific language without user choice.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
if not shutil.which('ffmpeg'):
print("错误：未检测到 ffmpeg")
print("请安装：")
print(" Ubuntu/Debian: sudo apt install ffmpeg")
print(" macOS: brew install ffmpeg")
print(" Windows: https://ffmpeg.org/download.html")
sys.exit(1)
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
if not shutil.which('ffmpeg'):
print("错误：未检测到 ffmpeg")
print("请安装：")
print(" Ubuntu/Debian: sudo apt install ffmpeg")
print(" macOS: brew install ffmpeg")
print(" Windows: https://ffmpeg.org/download.html")
sys.exit(1)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
filepath
]
try:
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode == 0:
parts = result.stdout.strip().split(',')
return {
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
filepath
]
try:
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode == 0:
parts = result.stdout.strip().split(',')
return {
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
filepath
]
try:
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode == 0:
parts = result.stdout.strip().split(',')
return {
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
filepath
]
try:
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode == 0:
parts = result.stdout.strip().split(',')
return {
The CLI interface presented by argparse is entirely in Chinese, including the command description and option help strings. Because the skill does not provide a language toggle or explain that it is intentionally limited to Chinese-speaking users, it forces a specific locale on all users.
All headings, descriptions, and troubleshooting text are presented only in Chinese, which can be a language-policy concern when a skill or reference forces a single language without user opt-in. There is no note indicating that this is a region-specific guide or that alternative language support is available.
This markdown guide provides many ffmpeg commands that create output files and transform user media, including batch conversion examples, but it does not include any warning that these commands write new files, may overwrite existing outputs, or should be tested on copies first. Under the markdown-specific missing-warning rule, documentation that affects user data should disclose potential data-impacting behavior.
No suspicious patterns detected.