Video Transcribe - 视频转文字

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:43 AM UTC
• Version: 1.0.3

Overview

This local transcription skill is not clearly malicious, but it needs review because first run can automatically install an unpinned package from a third-party mirror and persist changes in the user's Python environment.

Install only if you are comfortable with first-run network downloads and user-level Python environment changes. For safer use, install Whisper yourself in a dedicated virtual environment with pinned versions, avoid shared directories for sensitive recordings because transcript files are written next to the media, and run only after reviewing the dependency source you intend to trust.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: transcribe.py:67

Finding

Automatic Installation of an Unpinned Dependency from a Third-Party Package Index

Content

View full analysis

Vulnerability Details

File Location: transcribe.py, lines 67-72
Vulnerability Type: Supply-chain risk through automatic installation of mutable dependencies from a third-party package index
Risk Level: Medium

Vulnerable Code

python

subprocess.check_call([
    sys.executable, "-m", "pip", "install", 
    "openai-whisper",
    "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",
    "--break-system-packages", "--user"
])

Technical Analysis

When Whisper is unavailable, the Skill automatically invokes pip and installs openai-whisper from a third-party package index. The dependency has no pinned version, and neither it nor its transitive dependencies are verified with cryptographic hashes.

Consequently, the code executed during installation is not fixed to the version reviewed during this audit. A compromised package-index mirror, malicious upstream release, or compromised transitive dependency could introduce arbitrary package installation code. Python packages can execute code during build or installation, making this an execution-capable supply-chain boundary rather than a simple data download.

The --break-system-packages option bypasses protections intended to prevent pip from modifying externally managed Python environments. Although --user generally limits installation to the invoking user's package directory, using both options may still cause dependency conflicts, shadow trusted modules, or alter the behavior of other Python applications run by that user.

The automatic installation behavior is disclosed in SKILL.md, but disclosure does not address the lack of version pinning, integrity verification, isolation, or approval immediately before installation.

Attack Path

1. A user invokes transcribe.py on a system where the Whisper CLI is not detected.
2. main() calls install_whisper().
3. The Skill launches pip against https://pypi.tuna.tsinghua.edu.cn/simple.
4. pip dynamically resolves the latest availa ...[truncated 1126 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove automatic dependency installation from the runtime transcription path. Detect missing dependencies and require an explicit installation step or clear user confirmation.
2. Pin openai-whisper and every transitive dependency to reviewed versions in a lock file.
3. Require cryptographic hashes, such as with pip install --require-hashes -r requirements.txt, so altered artifacts are rejected.
4. Prefer a trusted official package index or an organization-controlled repository that synchronizes and verifies approved artifacts.
5. Install dependencies in a dedicated virtual environment rather than the user's shared Python environment.
6. Remove --break-system-packages to preserve externally managed environment protections.
7. Use binary wheels from trusted sources where practical and prevent unexpected source builds.
8. Document expected package versions, artifact hashes, download sources, and the fact that dependency and model acquisition requires network access.
9. Re-audit and update the lock file through a controlled dependency-update process rather than resolving the newest available versions during normal execution.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill claims to be fully local, offline, and privacy-preserving, but the documented behavior includes automatic network installation of openai-whisper from a third-party mirror and optional AI summarization output. This mismatch is dangerous because it can mislead users into running software under false assumptions about network access, supply-chain exposure, and privacy boundaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill advertises itself as offline/privacy-preserving, but the code silently reaches out to an external package mirror to install Whisper. That mismatch is security-relevant because users may trust the tool with sensitive media under the assumption that it performs no network activity, while it actually introduces supply-chain and privacy exposure.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · PUBLISH.md (reported line 50)May include surrounding context.

安装 ffmpeg（视频处理依赖）

brew install ffmpeg # macOS sudo apt install ffmpeg # Linux

text

### 3️⃣ 开始使用

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · PUBLISH.md (reported line 214)May include surrounding context.

安装 ffmpeg（视频处理依赖）

brew install ffmpeg # macOS sudo apt install ffmpeg # Linux

text

### 3️⃣ 开始使用

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file uses Chinese throughout headings, instructions, warnings, and examples, which effectively forces a specific language for users. The policy requires flagging language or locale constraints when they are imposed without user opt-in or explicit justification.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documentation describes behavior that reads local media files, writes transcript outputs, and invokes shell commands, but it does not declare any explicit tool scope or permissions. This is dangerous because users and hosting platforms cannot accurately constrain or review the skill’s operational privileges, increasing the chance of unexpected file modification or command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installation section mentions automatic Whisper installation but does not provide a prominent security warning that this will download packages over the network and alter the local environment. This is dangerous because silent dependency installation expands the attack surface through supply-chain risk and may violate user expectations in environments that require deterministic or offline operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The user-facing strings, installation guidance, and usage examples are presented only in Chinese, which imposes a specific language on users without any opt-in or alternative locale. Under the policy, language constraints should either be optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · transcribe.py (reported line 33)May include surrounding context.

python

for cmd in paths_to_try:
        try:
            result = subprocess.run([cmd, '--help'], capture_output=True, text=True, timeout=5)
            # whisper 没有 --version，但 --help 会返回帮助信息
            if 'usage: whisper' in result.stdout or result.returncode == 2:  # 返回 2 表示缺少 audio 参数，说明命令存在
                return True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · transcribe.py (reported line 46)May include surrounding context.

python

def check_whisper_with_cmd(cmd):
    """检查指定的 whisper 命令是否可用"""
    try:
        result = subprocess.run([cmd, '--version'], capture_output=True, text=True)
        return result.returncode == 0
    except (FileNotFoundError, Exception):
        return False

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · transcribe.py (reported line 55)May include surrounding context.

python

def check_ffmpeg():
    """检查 ffmpeg 是否安装"""
    try:
        result = subprocess.run(['ffmpeg', '-version'], capture_output=True, text=True)
        return result.returncode == 0
    except FileNotFoundError:
        return False

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Automatic package installation is broader capability than necessary for simply transcribing a local file and causes the tool to modify the host environment. In a skill context, unexpected environment changes and downloading executable dependencies are risky because they expand attack surface and reduce user control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Installing a package automatically without prior confirmation causes unreviewed network access and code introduction into the user's environment. Because this is a local-media tool, users would not reasonably expect it to alter their Python environment or trust a third-party mirror implicitly.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

The script automatically performs a network package installation at runtime from an external package index while claiming to be fully offline/local. This introduces supply-chain risk, executes newly downloaded code in the user's environment, and uses --break-system-packages without explicit consent, making the behavior more dangerous than a normal transcription utility.

Content

Scanner excerpt · transcribe.py (reported line 68)May include surrounding context.

python

print("")
    try:
        # 使用 pip 模块安装方式，更可靠
        subprocess.check_call([
            sys.executable, "-m", "pip", "install", 
            "openai-whisper",
            "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · PUBLISH.md (reported line 211)May include surrounding context.

md

print("❌ 未检测到 ffmpeg，请先安装：")
    print("")
    print("  macOS:  brew install ffmpeg")
    print("  Linux:  sudo apt install ffmpeg")
    print("")
    sys.exit(1)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · transcribe.py (reported line 91)May include surrounding context.

python

print("❌ 未检测到 ffmpeg，请先安装：")
    print("")
    print("  macOS:  brew install ffmpeg")
    print("  Linux:  sudo apt install ffmpeg")
    print("")
    sys.exit(1)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest describes a local video transcription skill, but the code also implements transcript summarization and persists a separate summary JSON file. Summarization is a distinct higher-level content-processing feature that is not disclosed in the stated purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The function signature sets the default transcription language to "zh", and the CLI help also presents Chinese-first behavior. This imposes a specific language/locale by default rather than offering neutral auto-detection or explicit user choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · transcribe.py (reported line 212)May include surrounding context.

python

# 执行转录
    try:
        result = subprocess.run(cmd, capture_output=True, text=True)
        
        if result.returncode == 0:
            print("")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The CLI initializes the language setting to "zh" before parsing user arguments, so users who do not specify a language are forced into a Chinese locale. This is a natural-language policy concern because the tool does not offer a neutral default or explicit language choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown explicitly states that multiple output files are generated in the same directory, including transcript, subtitle, log, and summary files. Because these files may expose sensitive spoken content or metadata, the skill description should disclose this data-writing behavior more clearly as a user warning rather than only as a feature description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest uses Chinese-only natural-language fields for the display name and slogan, but provides no indication that the skill is region-specific or that users can choose another language. Under the stated policy, forcing a specific language without opt-in or justification can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The stated purpose is local video-to-text transcription, which reasonably covers transcript output, but this code also writes a structured summary JSON artifact when summarization is enabled. That is a broader document-generation behavior than the manifest explicitly claims.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.