视频主题凝练及制作

• Outcome: Review
• Latest audit: Oct 19, 2026 · 5:55 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a disclosed video-production workflow, but it deserves Review because it explicitly removes AI/vendor watermarks and can overwrite local media outputs while sending narration text to a cloud TTS service.

Install only if you are comfortable with a Chinese-language media workflow that creates a local virtual environment, installs Python packages, runs ffmpeg, sends narration text to edge-tts, and writes or overwrites media files. Use the watermark-removal step only for assets you are authorized to modify, and prefer writing outputs to a dedicated project directory rather than running scripts on broad paths or originals.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (47)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This mismatch is more concerning because it includes image watermark removal, which can facilitate unauthorized alteration of media and bypass provenance or ownership markings while being insufficiently disclosed in the top-level purpose. In the context of an agent skill that can read/write files and run scripts, hidden or underemphasized content-modification behavior increases abuse potential and user deception risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch is more concerning because it includes image watermark removal, which can facilitate unauthorized alteration of media and bypass provenance or ownership markings while being insufficiently disclosed in the top-level purpose. In the context of an agent skill that can read/write files and run scripts, hidden or underemphasized content-modification behavior increases abuse potential and user deception risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch is more concerning because it includes image watermark removal, which can facilitate unauthorized alteration of media and bypass provenance or ownership markings while being insufficiently disclosed in the top-level purpose. In the context of an agent skill that can read/write files and run scripts, hidden or underemphasized content-modification behavior increases abuse potential and user deception risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This mismatch is more concerning because it includes image watermark removal, which can facilitate unauthorized alteration of media and bypass provenance or ownership markings while being insufficiently disclosed in the top-level purpose. In the context of an agent skill that can read/write files and run scripts, hidden or underemphasized content-modification behavior increases abuse potential and user deception risk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

This mismatch is more concerning because it includes image watermark removal, which can facilitate unauthorized alteration of media and bypass provenance or ownership markings while being insufficiently disclosed in the top-level purpose. In the context of an agent skill that can read/write files and run scripts, hidden or underemphasized content-modification behavior increases abuse potential and user deception risk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

8. 渲染：`render_stream_whiteboard.py`（传 `assets/drawing-hand-clean.png`）

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 95% confidence

Finding

The script accepts an arbitrary --output path and passes it to ffmpeg with -y, which forces overwrite of any existing file without confirmation. In an agent/workflow context where paths may be influenced by upstream inputs, this can overwrite unintended files and damage local artifacts or user data.

Content

Scanner excerpt · scripts/merge_scenes.py (reported line 32)May include surrounding context.

python

f.write(f"file '{p.resolve().as_posix()}'\n")
        list_path = Path(f.name)
    try:
        res = subprocess.run(
            [ffmpeg, "-y", "-loglevel", "error", "-f", "concat", "-safe", "0",
             "-i", str(list_path), "-c", "copy", str(output)],
            capture_output=True, text=True,

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 95% confidence

Finding

The fallback ffmpeg re-encode path has the same unsafe output handling: a caller-controlled output path is written directly and existing files are overwritten due to -y. Because this skill is designed for batch media generation, it is plausible that user- or document-derived parameters flow into output naming, making accidental or unauthorized file clobbering more likely.

Content

Scanner excerpt · scripts/merge_scenes.py (reported line 41)May include surrounding context.

python

print(f"  ffmpeg 无损拼接完成: {output}")
            return True
        print(f"  [warn] ffmpeg -c copy 失败，尝试重编码: {res.stderr.strip()[:200]}")
        res = subprocess.run(
            [ffmpeg, "-y", "-loglevel", "error", "-f", "concat", "-safe", "0",
             "-i", str(list_path), "-c:v", "libx264", "-crf", "20",
             "-pix_fmt", "yuv420p", "-vf", "scale='trunc(iw/2)*2':'trunc(ih/2)*2'", str(output)],

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/prepare_env.py (reported line 47)May include surrounding context.

python

def child_env() -> dict:
    """给子进程一个干净、可复现的环境（避免继承外部 PYTHONPATH/PYTHONHOME）。"""
    env = os.environ.copy()
    for key in ("PYTHONPATH", "PYTHONHOME", "VIRTUAL_ENV"):
        env.pop(key, None)
    return env

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script is explicitly designed to remove a vendor watermark ('AI生成 / WORKBUDDY') from generated images, which is a content provenance and rights-management marker rather than a necessary step for educational video production. This enables evasion of attribution or platform restrictions and is directly misaligned with the stated skill purpose, making it an abusive capability rather than a benign utility.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README is entirely in Chinese and specifies a Chinese TTS voice (zh-CN-YunxiNeural) as part of the workflow, with no indication that users can choose another language or locale. This can violate a language/locale policy when the skill implicitly enforces one language without opt-in or justification.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes and instructs use of shell execution, environment preparation, and file read/write operations, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an overbroad execution surface where an agent may invoke powerful local capabilities without a clear least-privilege boundary, increasing the chance of unsafe command execution or unintended file access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that it uses edge-tts/cloud voice synthesis but provides no warning that user-provided text may be sent to an external service. In an education workflow, documents may contain unpublished, copyrighted, regulated, or personal content, so silent transmission to a cloud provider creates a real confidentiality and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The natural-language instructions, role description, and usage guidance are entirely in Chinese, which imposes a specific language on users without offering a choice or stating that the skill is region-specific. The policy explicitly disallows forced language or locale constraints unless they are optional or clearly justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrase list is broad and unconstrained, so the skill may activate for many generic education or video-production requests without clear user intent to use this specific workflow. Over-broad activation can cause unintended routing, reducing user control and potentially causing the agent to apply this skill's assumptions, output format, and processing steps in contexts where they were not requested.

Content

No source excerpt is available for this finding.

Tainted flow: 'out_path' from open (line 29, file read) → open (file write)

Medium

• Category: Data Flow
• Confidence: 88% confidence

Finding

The script writes to a path derived from untrusted inputs: either the user-supplied --out argument or the plan file's work field. If this script is run in an automated pipeline on attacker-controlled JSON, it can overwrite arbitrary files accessible to the process, which is a path traversal / arbitrary file write risk.

Content

Scanner excerpt · scripts/make_subtitle_plan.py (reported line 30)May include surrounding context.

python

out.append({"idx": idx, "start": seg["start"], "file": f"seg{idx:02d}.wav"})

    out_path = a.out or os.path.join(plan.get("work", "."), "subtitle_plan.json")
    json.dump(out, open(out_path, "w", encoding="utf-8"), ensure_ascii=False, indent=2)
    print(f"已写出 subtitle_plan.json ({len(out)} 段) -> {out_path}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/merge_scenes.py (reported line 32)May include surrounding context.

python

f.write(f"file '{p.resolve().as_posix()}'\n")
        list_path = Path(f.name)
    try:
        res = subprocess.run(
            [ffmpeg, "-y", "-loglevel", "error", "-f", "concat", "-safe", "0",
             "-i", str(list_path), "-c", "copy", str(output)],
            capture_output=True, text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/merge_scenes.py (reported line 41)May include surrounding context.

python

print(f"  ffmpeg 无损拼接完成: {output}")
            return True
        print(f"  [warn] ffmpeg -c copy 失败，尝试重编码: {res.stderr.strip()[:200]}")
        res = subprocess.run(
            [ffmpeg, "-y", "-loglevel", "error", "-f", "concat", "-safe", "0",
             "-i", str(list_path), "-c:v", "libx264", "-crf", "20",
             "-pix_fmt", "yuv420p", "-vf", "scale='trunc(iw/2)*2':'trunc(ih/2)*2'", str(output)],

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file-level description and defaults are centered on Chinese narration, including the default voice zh-CN-YunxiNeural and Chinese-language workflow, but there is no natural-language indication that users can choose another language or locale. Under the policy rule, forcing a specific language/locale without user opt-in is a violation unless the constraint is clearly documented and justified as region-specific.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/narrate_edge_tts.py (reported line 54)May include surrounding context.

python

r = f"{rate:+d}%"
    for attempt in range(retries):
        try:
            subprocess.run([sys.executable, "-m", "edge_tts", "--voice", voice,
                            "--rate", r, "--text", text, "--write-media", out_mp3],
                           check=True, capture_output=True, timeout=120)
            if os.path.exists(out_mp3) and os.path.getsize(out_mp3) > 1000:

Tainted flow: 'voice' from open (line 77, file read) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/narrate_edge_tts.py (reported line 54)May include surrounding context.

python

r = f"{rate:+d}%"
    for attempt in range(retries):
        try:
            subprocess.run([sys.executable, "-m", "edge_tts", "--voice", voice,
                            "--rate", r, "--text", text, "--write-media", out_mp3],
                           check=True, capture_output=True, timeout=120)
            if os.path.exists(out_mp3) and os.path.getsize(out_mp3) > 1000:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/narrate_edge_tts.py (reported line 67)May include surrounding context.

python

def to_wav_trim(mp3, wav, sr):
    """mp3→wav 并裁掉首尾静音（-45dB 阈值）。"""
    subprocess.run([FFMPEG, "-y", "-loglevel", "error", "-i", mp3,
                    "-af", "silenceremove=start_periods=1:start_threshold=-45dB:start_silence=0.02,"
                           "areverse,silenceremove=start_periods=1:start_threshold=-45dB:start_silence=0.02,areverse",
                    "-ar", str(sr), "-ac", "1", wav], check=True, capture_output=True, timeout=120)

Tainted flow: 'FFMPEG' from os.environ.get (line 35, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 92% confidence

Finding

The executable path for ffmpeg is taken from the FFMPEG_PATH environment variable and then executed directly. If an attacker can influence the environment in which this skill runs, they can cause the script to execute an arbitrary binary, resulting in arbitrary code execution under the skill's privileges.

Content

Scanner excerpt · scripts/narrate_edge_tts.py (reported line 67)May include surrounding context.

python

def to_wav_trim(mp3, wav, sr):
    """mp3→wav 并裁掉首尾静音（-45dB 阈值）。"""
    subprocess.run([FFMPEG, "-y", "-loglevel", "error", "-i", mp3,
                    "-af", "silenceremove=start_periods=1:start_threshold=-45dB:start_silence=0.02,"
                           "areverse,silenceremove=start_periods=1:start_threshold=-45dB:start_silence=0.02,areverse",
                    "-ar", str(sr), "-ac", "1", wav], check=True, capture_output=True, timeout=120)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/narrate_edge_tts.py (reported line 124)May include surrounding context.

python

print("音轨:", audio_wav, f"{len(track)/sr:.1f}s")

    # 4) 混音（视频流 copy，不二次编码）
    subprocess.run([FFMPEG, "-y", "-loglevel", "error",
                    "-i", video, "-i", audio_wav,
                    "-map", "0:v", "-map", "1:a",
                    "-c:v", "copy", "-c:a", "aac", "-b:a", "192k",

Tainted flow: 'FFMPEG' from os.environ.get (line 35, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 92% confidence

Finding

This is the same underlying issue as above: the program to execute comes from an environment variable, which is a tainted source. In deployment environments where users, wrappers, CI jobs, or adjacent processes can set environment variables, this can be leveraged for arbitrary program execution.

Content

Scanner excerpt · scripts/narrate_edge_tts.py (reported line 124)May include surrounding context.

python

print("音轨:", audio_wav, f"{len(track)/sr:.1f}s")

    # 4) 混音（视频流 copy，不二次编码）
    subprocess.run([FFMPEG, "-y", "-loglevel", "error",
                    "-i", video, "-i", audio_wav,
                    "-map", "0:v", "-map", "1:a",
                    "-c:v", "copy", "-c:a", "aac", "-b:a", "192k",

Static analysis

No suspicious patterns detected.