Video Slicer — 视频智能切片工具

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:14 AM UTC
• Version: 1.2.0

Overview

This is a local video-slicing helper whose risky behaviors are mostly expected for media processing, with some install and overwrite cautions.

Install this only in a dedicated virtual environment, avoid running package installs with elevated privileges unless your OS package manager requires it, and choose a fresh output directory because examples and the script overwrite generated files. Expect local Whisper model downloads/cache and local creation of frames, audio, transcripts, and clips.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:66

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

--hash=sha256: opencc-python-reimplemented== --hash=sha256: torch== --hash=sha256: ``` 5. Use a dedicated virtual environment with no elevated privileges. 6. Review and lock transitive dependencies, not only the top-level packages. 7. Perform dependency vulnerability and provenance checks in CI. 8. Document trusted package indexes explicitly and avoid user-configured fallback indexes. 9. Verify runtime-downloaded Whisper model artifacts against documented checksums or distribute a signed model manifest. 10. Periodically update dependency pins through a controlled review and testing process. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (22)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · README.md (reported line 117)May include surrounding context.

bash

# apt 安装 ffmpeg
sudo apt update && sudo apt install -y ffmpeg

# pip 安装 Python 依赖
pip3 install openai-whisper opencc-python-reimplemented torch torchvision --index-url https://download.pytorch.org/whl/cpu

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · README.md (reported line 127)May include surrounding context.

bash

# apt 安装 ffmpeg
sudo apt update && sudo apt install -y ffmpeg

# pip 安装 Python 依赖
pip3 install openai-whisper opencc-python-reimplemented torch torchvision --index-url https://download.pytorch.org/whl/cpu

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description presents an end-to-end intelligent video slicing tool that takes a long video and automatically identifies thematic segments, analyzes content, and cuts complete short videos of target duration. The supplied code only partially matches that workflow: it does sample frames and perform Whisper-based Chinese transcription, and it includes an ffmpeg-based cutter. However, the core intelligence implied by the description is missing. There is no content-analysis logic, no topic segmentation, no selection of clip boundaries, no generation of a clip plan from transcript or frames, and no CLI path that automatically cuts clips from a long video. For long videos, the script merely advises the user to inspect frames and manually choose a transcription range. The batch cutting function exists, but only as a helper that depends on an externally provided plan. Therefore the implemented behavior is materially narrower than the declared purpose, making this a description/behavior mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README says the skill triggers on broad natural-language requests such as “帮我把这个视频切成短视频” and “帮我做自媒体用的视频切片.” These phrases are generic enough that they could match ordinary conversation or requests that do not specifically intend to invoke this particular skill, and the document does not provide exclusion conditions or tighter scope constraints.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 117)May include surrounding context.

bash

# apt 安装 ffmpeg
sudo apt update && sudo apt install -y ffmpeg

# pip 安装 Python 依赖
pip3 install openai-whisper opencc-python-reimplemented torch torchvision --index-url https://download.pytorch.org/whl/cpu

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 127)May include surrounding context.

bash

# apt 安装 ffmpeg
sudo apt update && sudo apt install -y ffmpeg

# pip 安装 Python 依赖
pip3 install openai-whisper opencc-python-reimplemented torch torchvision --index-url https://download.pytorch.org/whl/cpu

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example hard-codes language="zh", which imposes a specific language setting rather than letting the user choose or documenting that the skill is intentionally Chinese-only. This can violate language/locale policy expectations when the skill may be used on non-Chinese audio or by users who have not opted into that locale assumption.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill clearly instructs use of shell commands, environment manipulation, and file creation/overwrite, but it does not declare any tool scope such as allowed-tools or permissions. That creates an authorization and review gap: an agent may execute ffmpeg, python, and file writes without an explicit least-privilege contract, increasing the chance of unintended command execution or destructive file operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description states support for Chinese speech recognition, and later examples hard-code Whisper with language='zh' and use Chinese-only processing assumptions. This imposes a specific language/locale behavior without indicating that users can choose another language or opt in to Chinese-only handling.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation description and trigger list include phrases like “视频剪辑”, “自媒体视频”, and “演讲精华”, which are broad and may overlap with many general media-editing requests rather than this specific long-video slicing workflow. The file does not provide exclusion conditions or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented commands use ffmpeg with '-y', which forces overwrite of existing files, and the skill writes multiple artifacts to predictable directories. Without an explicit warning or safe output handling, an agent or user may unintentionally destroy existing data or clobber prior outputs during routine use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The sample code explicitly sets language='zh', which enforces a language choice in processing behavior. No nearby text indicates that this is configurable or only an example default, so it reads as a mandatory locale constraint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_slicer.py (reported line 112)May include surrounding context.

python

"""
    import re

    result = subprocess.run(
        ["ffmpeg", "-i", video_path],
        capture_output=True, text=True
    )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_slicer.py (reported line 170)May include surrounding context.

python

out_path = os.path.join(frames_dir, f"frame_{safe_ts}.jpg")

        if not os.path.exists(out_path):
            proc = subprocess.run([
                "ffmpeg", "-y",
                "-ss", ts,
                "-i", video_path,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_slicer.py (reported line 216)May include surrounding context.

python

out_path = os.path.join(frames_dir, f"{label}_{safe_ts}.jpg")

        if not os.path.exists(out_path):
            subprocess.run([
                "ffmpeg", "-y",
                "-ss", ts,
                "-i", video_path,

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script globally overrides Python's default SSL context and sets SSL_CERT_FILE for the process, changing trust behavior beyond the needs of a local media-processing tool. This broad side effect can impact any later network operations in the same process or imported libraries, making TLS behavior less predictable and expanding the blast radius if certificate handling is misconfigured or abused.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_slicer.py (reported line 283)May include surrounding context.

python

# === Step 1: 提取音频 ===
    print(f"[1/3] 提取音频: {ts_start} ~ {ts_end} ({duration}秒)", file=sys.stderr)
    result = subprocess.run([
        "ffmpeg", "-y",
        "-i", video_path,
        "-ss", ts_start,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code passes language="zh" to Whisper, forcing Chinese transcription regardless of the input or user preference. This matches the language/locale policy violation category because the skill enforces a specific language without opt-in or an explicit region-specific justification.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/video_slicer.py (reported line 360)May include surrounding context.

python

"whisper_model": model_name,
            "device": device,
            "total_segments": len(segments),
            "generated_at": __import__("datetime").datetime.now().isoformat(),
        },
        "segments": segments,
    }

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_slicer.py (reported line 431)May include surrounding context.

python

dur_sec = time_to_seconds(end) - time_to_seconds(start)
        print(f"[{i}/{total}] {title} ({start} -> {end}, ~{dur_sec // 60}min{dur_sec % 60}s)", file=sys.stderr)

        proc = subprocess.run([
            "ffmpeg", "-y",
            "-ss", start,
            "-to", end,

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README describes automatic sampling, transcription, and output generation, but it does not clearly warn users up front that the workflow creates extracted frames, audio segments, transcript files, and clipped videos on local storage. Because these operations affect user data layout and disk usage, a concise disclosure would better prepare users before execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The command-line examples use '--language zh' for Whisper in both the discouraged and recommended flows. Because no optionality is mentioned, the documentation reinforces a fixed-language policy rather than a user-selected setting.

Content

No source excerpt is available for this finding.