NVIDIA AV1 Video Compressor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.1

Overview

This appears to be a real NVIDIA video-compression skill, but it has review-worthy safety gaps around unattended batch execution and automatic dependency installation.

Review this before installing. Use it only with explicit input and output folders, start with test mode, and do not let an agent run full compression unattended. Prefer installing pinned dependencies yourself in an isolated environment before running the skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/compress_videos.py:21

Finding

Automatic Installation of an Unpinned Dependency from a Third-Party Package Index

Content

View full analysis

Vulnerability Details

File Location: scripts/compress_videos.py:21-25
Vulnerability Type: Insecure runtime dependency installation
Risk Level: Medium

Vulnerable Code

python

try:
    from tqdm import tqdm
except ImportError:
    print("正在安装依赖库 tqdm...")
    subprocess.run([sys.executable, "-m", "pip", "install", "tqdm", "-i", "https://pypi.tuna.tsinghua.edu.cn/simple"], 
                   capture_output=True)
    from tqdm import tqdm

The related dependency declaration in requirements.txt:1 is also not pinned to an exact version:

text

tqdm>=4.60.0

Technical Analysis

When tqdm is unavailable, merely launching the compression script causes it to invoke pip and install the latest resolvable version of the package from a third-party PyPI mirror. The installation command neither pins an exact audited version nor verifies package hashes.

This makes the code executed by the Skill mutable after review. If the configured mirror, an upstream package release, DNS or network path, or package-resolution process is compromised, attacker-controlled package installation or import-time code could execute under the identity running the Skill.

Although the package name is a known dependency rather than an apparent typosquat, automatic installation from an external source without integrity controls is an unsafe supply-chain practice.

Attack Path

1. A user or Agent launches scripts/compress_videos.py.
2. The environment does not have an importable tqdm package.
3. The ImportError handler automatically runs:

   bash

   python -m pip install tqdm -i https://pypi.tuna.tsinghua.edu.cn/simple
   

4. Pip resolves and downloads mutable package content without an exact version or required hashes.
5. A compromised package source or distribution supplies malicious code.
6. Installation hooks or the subsequent from tqdm import tqdm execute that code with the current process user's privileges.

Impact Assessment

Su ...[truncated 614 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the runtime pip install operation. If tqdm is unavailable, exit with a clear dependency-installation error or continue without optional progress reporting.
2. Install dependencies as a separate, explicit deployment step before executing the Skill.
3. Pin tqdm to a reviewed exact version rather than using tqdm>=4.60.0.
4. Use a lock file or hash-checked requirements file, for example with pip's --require-hashes.
5. Retrieve packages only from an organization-approved repository or a trusted package index with appropriate integrity and access controls.
6. Build and test the Skill in an isolated virtual environment or container with preinstalled dependencies.
7. If automatic installation is unavoidable, require explicit user consent, pin the exact version, enforce hashes, and surface installation failures rather than suppressing pip output.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (89)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

--no-confirm lowers the safety barrier for a file-processing tool and can be abused when combined with broad agent activation or loosely validated input paths. Even if the tool claims to protect originals, autonomous bulk processing can consume significant resources, overwrite outputs, or operate on unintended directories, making this a meaningful parameter-abuse risk in context.

Content

Scanner excerpt · FINAL_REPORT.md (reported line 101)May include surrounding context.

方式1：直接使用脚本

bash

python scripts/compress_videos.py -i "输入目录" -p B --no-confirm

方式2：通过Agent统一接口

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The hardcoded --no-confirm parameter suppresses safety prompts for a potentially large-scale file operation, which is a tool-parameter abuse pattern in an agent setting. Because the skill is specifically designed for batch video compression, disabling confirmations makes the context more dangerous: a mistaken input directory or unsafe downstream script behavior could affect many files at once without interruption.

Content

Scanner excerpt · agent_interface.py (reported line 118)May include surrounding context.

python

cmd.extend(["-o", output_dir])
    
    # 非交互模式
    cmd.append("--no-confirm")
    
    print(f"执行命令: {' '.join(cmd)}")

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 88% confidence

Finding

The documented '--no-confirm' parameter can be abused by downstream agents or users to suppress safety prompts and execute compression on arbitrary directories without interactive verification. Although this README is only documentation, normalizing this parameter in quick-start commands makes unsafe usage more likely in automation-heavy environments.

Content

Scanner excerpt · locales/de/README.md (reported line 25)May include surrounding context.

md

python scripts/compress_videos.py

# Befehlszeilenmodus
python scripts/compress_videos.py -i "/path/to/videos" -p B --no-confirm

# Testmodus
python scripts/compress_videos.py -i "/path/to/videos" -p B --test

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The --no-confirm flag can be abused in tooling or agent workflows to suppress a safety checkpoint around batch video compression, enabling large-scale processing without user review. In combination with broad input paths or unclear output behavior, this raises the risk of destructive workflow mistakes, storage exhaustion, or accidental processing of unintended files.

Content

Scanner excerpt · locales/ko/README.md (reported line 25)May include surrounding context.

md

python scripts/compress_videos.py

# 명령줄 모드
python scripts/compress_videos.py -i "/path/to/videos" -p B --no-confirm

# 테스트 모드
python scripts/compress_videos.py -i "/path/to/videos" -p B --test

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 83% confidence

Finding

--no-confirm is a risky parameter because it suppresses an important safeguard on a tool that performs batch filesystem operations. While the README itself is not executable, advertising this flag without safety caveats can lead users or agents to invoke the tool in unsafe ways, amplifying mistakes into widespread unwanted output generation or overwriting behavior.

Content

Scanner excerpt · locales/zh-CN/README.md (reported line 25)May include surrounding context.

md

python scripts/compress_videos.py

# 命令行模式
python scripts/compress_videos.py -i "/path/to/videos" -p B --no-confirm

# 测试模式
python scripts/compress_videos.py -i "/path/to/videos" -p B --test

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The README promotes a dangerous parameter combination by showcasing --no-confirm for bulk video compression, which can be abused to run modifying operations unattended on arbitrary paths. In a tool exposed to agents, such flags materially increase the blast radius of misuse because a mistaken or manipulated input directory may affect many files at once.

Content

Scanner excerpt · locales/zh-TW/README.md (reported line 25)May include surrounding context.

md

python scripts/compress_videos.py

# 命令列模式
python scripts/compress_videos.py -i "/path/to/videos" -p B --no-confirm

# 測試模式
python scripts/compress_videos.py -i "/path/to/videos" -p B --test

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

md

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 149)May include surrounding context.

md

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · locales/ar/README.md (reported line 25)May include surrounding context.

md

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · locales/en/README.md (reported line 25)May include surrounding context.

md

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · locales/es/README.md (reported line 25)May include surrounding context.

md

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · locales/fr/README.md (reported line 25)May include surrounding context.

md

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · locales/ja/README.md (reported line 25)May include surrounding context.

md

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · locales/ru/README.md (reported line 25)May include surrounding context.

md

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/compress_videos.py (reported line 586)May include surrounding context.

python

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/compress_videos.py (reported line 628)May include surrounding context.

python

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/compress_videos.py (reported line 800)May include surrounding context.

python

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skill.json (reported line 38)May include surrounding context.

json

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skill.json (reported line 74)May include surrounding context.

json

python compress_videos.py -i "E:\\视频" -p B --test

  # 非交互模式（跳过确认）
  python compress_videos.py -i "E:\\视频" -p A --no-confirm

压缩方案:
  A - 保守压缩（保持1080p，CRF23）

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrases are broad everyday-language requests like '压缩视频' and '减少视频空间', which can cause the agent to proactively recommend and potentially invoke this skill in contexts where the user did not explicitly request this specific tool. In a file-processing skill that operates on user-supplied directories and can lead to batch transformations of media, overly broad activation increases the risk of unintended actions and poor consent boundaries.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

The documented use of --no-confirm explicitly enables operation without an interactive confirmation checkpoint. For a tool that performs batch processing on user files, removing confirmation increases the risk of unintended large-scale modifications or processing runs initiated by an agent or script without meaningful user review.

Content

Scanner excerpt · FINAL_REPORT.md (reported line 101)May include surrounding context.

方式1：直接使用脚本

bash

python scripts/compress_videos.py -i "输入目录" -p B --no-confirm

方式2：通过Agent统一接口

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger example “帮我压缩视频” is overly generic and can cause the skill to be auto-selected for broad, everyday requests without enough context about file scope, user intent, or safety checks. In an agent ecosystem, this increases the chance of the wrong tool being invoked on arbitrary local media, leading to unintended processing or privacy-impacting actions.

Content

No source excerpt is available for this finding.