Video Slicer — 视频智能切片工具

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:14 AM UTC
• Version: 1.2.0

Overview

This is a local video-slicing helper whose risky behaviors are mostly expected for media processing, with some install and overwrite cautions.

Install this only in a dedicated virtual environment, avoid running package installs with elevated privileges unless your OS package manager requires it, and choose a fresh output directory because examples and the script overwrite generated files. Expect local Whisper model downloads/cache and local creation of frames, audio, transcripts, and clips.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:66
• Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `README.md:66-67`, `README.md:103-120`, `SKILL.md:310-312` **Vulnerability Type**: Unpinned and unverifiable third-party dependencies **Risk Level**: Medium ### Vulnerable Code `README.md:66-67`: ```bash pip install openai-whisper opencc-python-reimplemented torch brew install ffmpeg # macOS ``` `README.md:103-120` includes platform-specific installation commands such as: ```bash pip3 install openai-whisper opencc-python-reimplemented torch torchvision ``` ```bash pip3 install openai-whisper opencc-python-reimplemented torch torchvision --index-url https://download.pytorch.org/whl/cpu ``` `SKILL.md:310-312`: ```bash pip install openai-whisper opencc-python-reimplemented torch brew install ffmpeg # macOS ``` ### Technical Analysis The documented installation commands retrieve mutable package versions without exact version pins, cryptographic hashes, or a reviewed lockfile. Consequently, the code installed by users can differ from the dependencies that existed when the Skill was audited. Specifying the PyTorch package index changes the repository used for resolution but does not authenticate individual expected artifacts or constrain them to reviewed versions. The executable script subsequently imports `torch`, `whisper`, and `opencc`, so code contained in those installed packages runs in the user's Python process. This issue requires compromise or malicious replacement of an upstream package, release, dependency, or configured package repository. The audit did not find evidence that the currently named packages are malicious. ### Attack Path 1. An attacker compromises a dependency publisher account, package repository, or transitive dependency and publishes a malicious or backdoored release. 2. A user follows the Skill documentation and runs an unpinned `pip` installation command. 3. The package resolver selects the attacker-controlled release because no exact version or artifact hash is requ ...[truncated 1098 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a reviewed dependency lockfile containing exact direct and transitive versions. 2. Generate and record SHA-256 hashes for every permitted distribution artifact. 3. Install dependencies with hash verification, for example: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Pin dependencies exactly rather than using minimum or unconstrained versions: ```text openai-whisper==<reviewed-version> --hash=sha256:<reviewed-hash> opencc-python-reimplemented==<reviewed-version> --hash=sha256:<reviewed-hash> torch==<reviewed-version> --hash=sha256:<reviewed-hash> ``` 5. Use a dedicated virtual environment with no elevated privileges. 6. Review and lock transitive dependencies, not only the top-level packages. 7. Perform dependency vulnerability and provenance checks in CI. 8. Document trusted package indexes explicitly and avoid user-configured fallback indexes. 9. Verify runtime-downloaded Whisper model artifacts against documented checksums or distribute a signed model manifest. 10. Periodically update dependency pins through a controlled review and testing process. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (22)

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# apt 安装 ffmpeg
sudo apt update && sudo apt install -y ffmpeg

# pip 安装 Python 依赖
pip3 install openai-whisper opencc-python-reimplemented torch torchvision --index-url https://download.pytorch.org/whl/cpu

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# apt 安装 ffmpeg
sudo apt update && sudo apt install -y ffmpeg

# pip 安装 Python 依赖
pip3 install openai-whisper opencc-python-reimplemented torch torchvision --index-url https://download.pytorch.org/whl/cpu

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description presents an end-to-end intelligent video slicing tool that takes a long video and automatically identifies thematic segments, analyzes content, and cuts complete short videos of target duration. The supplied code only partially matches that workflow: it does sample frames and perform Whisper-based Chinese transcription, and it includes an ffmpeg-based cutter. However, the core intelligence implied by the description is missing. There is no content-analysis logic, no topic segmentation, no selection of clip boundaries, no generation of a clip plan from transcript or frames, and no CLI path that automatically cuts clips from a long video. For long videos, the script merely advises the user to inspect frames and manually choose a transcription range. The batch cutting function exists, but only as a helper that depends on an externally provided plan. Therefore the implemented behavior is materially narrower than the declared purpose, making this a description/behavior mismatch.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The README says the skill triggers on broad natural-language requests such as “帮我把这个视频切成短视频” and “帮我做自媒体用的视频切片.” These phrases are generic enough that they could match ordinary conversation or requests that do not specifically intend to invoke this particular skill, and the document does not provide exclusion conditions or tighter scope constraints.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# apt 安装 ffmpeg
sudo apt update && sudo apt install -y ffmpeg

# pip 安装 Python 依赖
pip3 install openai-whisper opencc-python-reimplemented torch torchvision --index-url https://download.pytorch.org/whl/cpu

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# apt 安装 ffmpeg
sudo apt update && sudo apt install -y ffmpeg

# pip 安装 Python 依赖
pip3 install openai-whisper opencc-python-reimplemented torch torchvision --index-url https://download.pytorch.org/whl/cpu

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The example hard-codes `language="zh"`, which imposes a specific language setting rather than letting the user choose or documenting that the skill is intentionally Chinese-only. This can violate language/locale policy expectations when the skill may be used on non-Chinese audio or by users who have not opted into that locale assumption.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly instructs use of shell commands, environment manipulation, and file creation/overwrite, but it does not declare any tool scope such as allowed-tools or permissions. That creates an authorization and review gap: an agent may execute ffmpeg, python, and file writes without an explicit least-privilege contract, increasing the chance of unintended command execution or destructive file operations.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The description states support for Chinese speech recognition, and later examples hard-code Whisper with language='zh' and use Chinese-only processing assumptions. This imposes a specific language/locale behavior without indicating that users can choose another language or opt in to Chinese-only handling.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The activation description and trigger list include phrases like “视频剪辑”, “自媒体视频”, and “演讲精华”, which are broad and may overlap with many general media-editing requests rather than this specific long-video slicing workflow. The file does not provide exclusion conditions or negative examples to clarify when the skill should not activate.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documented commands use ffmpeg with '-y', which forces overwrite of existing files, and the skill writes multiple artifacts to predictable directories. Without an explicit warning or safe output handling, an agent or user may unintentionally destroy existing data or clobber prior outputs during routine use.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The sample code explicitly sets language='zh', which enforces a language choice in processing behavior. No nearby text indicates that this is configurable or only an example default, so it reads as a mandatory locale constraint.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""
    import re

    result = subprocess.run(
        ["ffmpeg", "-i", video_path],
        capture_output=True, text=True
    )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

out_path = os.path.join(frames_dir, f"frame_{safe_ts}.jpg")

        if not os.path.exists(out_path):
            proc = subprocess.run([
                "ffmpeg", "-y",
                "-ss", ts,
                "-i", video_path,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

out_path = os.path.join(frames_dir, f"{label}_{safe_ts}.jpg")

        if not os.path.exists(out_path):
            subprocess.run([
                "ffmpeg", "-y",
                "-ss", ts,
                "-i", video_path,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The script globally overrides Python's default SSL context and sets SSL_CERT_FILE for the process, changing trust behavior beyond the needs of a local media-processing tool. This broad side effect can impact any later network operations in the same process or imported libraries, making TLS behavior less predictable and expanding the blast radius if certificate handling is misconfigured or abused.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# === Step 1: 提取音频 ===
    print(f"[1/3] 提取音频: {ts_start} ~ {ts_end} ({duration}秒)", file=sys.stderr)
    result = subprocess.run([
        "ffmpeg", "-y",
        "-i", video_path,
        "-ss", ts_start,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The code passes `language="zh"` to Whisper, forcing Chinese transcription regardless of the input or user preference. This matches the language/locale policy violation category because the skill enforces a specific language without opt-in or an explicit region-specific justification.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

"whisper_model": model_name,
            "device": device,
            "total_segments": len(segments),
            "generated_at": __import__("datetime").datetime.now().isoformat(),
        },
        "segments": segments,
    }

• Confidence: 75% confidence
• Finding: Dynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

dur_sec = time_to_seconds(end) - time_to_seconds(start)
        print(f"[{i}/{total}] {title} ({start} -> {end}, ~{dur_sec // 60}min{dur_sec % 60}s)", file=sys.stderr)

        proc = subprocess.run([
            "ffmpeg", "-y",
            "-ss", start,
            "-to", end,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The README describes automatic sampling, transcription, and output generation, but it does not clearly warn users up front that the workflow creates extracted frames, audio segments, transcript files, and clipped videos on local storage. Because these operations affect user data layout and disk usage, a concise disclosure would better prepare users before execution.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The command-line examples use '--language zh' for Whisper in both the discouraged and recommended flows. Because no optionality is mentioned, the documentation reinforces a fixed-language policy rather than a user-selected setting.

Static analysis

No suspicious patterns detected.