Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed, confirmation-first workflow for downloading user-provided public media and preparing optional translation inputs.
Before installing, be aware that this skill downloads media to local project folders, may create hidden reusable audio/subtitle inputs, and defaults to Chinese filenames or Chinese translation workflow settings unless you choose otherwise. Only use it for content you are allowed to save, and only approve the combined translation path if you are comfortable uploading processed audio to OkFile and sending transcription or translation data to the named Ali services.
声明描述的是一个具备实际媒体处理能力的技能：检查格式、下载公开视频、保存音频字幕封面，并为后续翻译流程准备输入。而提供的代码块只是打印固定的中文确认说明/问卷，用于收集用户偏好或展示工作流说明。代码中没有任何网络访问、文件下载、FFmpeg/yt-dlp 调用、媒体处理、路径创建、质量确认逻辑执行，甚至没有对用户输入进行后续处理。尤其 combined 模式还宣传了 OkFile、阿里 Fun-ASR、qwen-mt-plus、Agent 翻译等外发与翻译流程内容，但这些也只是文本说明，并未在代码中实现。故该代码的实际行为与声明的核心功能存在显著不一致。
The markdown states that ordinary video downloads will translate the original title into Chinese and use a Chinese cleaned title as the filename. This imposes a specific language/locale choice by default rather than offering the user a language preference or opt-in.
The contract instructs the agent to translate remote titles into the user's target language and specifically says Chinese output should use natural domain Chinese. Because the skill does not clearly require obtaining the user's language preference first, this can create an unwanted locale transformation policy by default.
The default prompt embeds complex activation and control-flow rules in a manifest field, including conditional behavior based on URL type, workflow combinations, and session persistence requirements. In a manifest, this ambiguity can cause the agent to trigger the skill in unintended contexts or follow hidden operational constraints that override user intent, increasing the risk of unauthorized downloads or workflow misuse.
The prompt requires translation of the original foreign-language title into Chinese and mandates a Chinese normalized title for visible output and downstream subtitle tasks, regardless of user preference. Forcing output language without opt-in can misrepresent source metadata, confuse users, and cause downstream file naming or provenance errors in multilingual media-handling workflows.
This file is a code file, so only SQP-2 and SQP-3 apply. The natural-language questionnaire states that the default output is translated into Simplified Chinese, which imposes a language choice by default rather than offering a neutral user-selected default. That matches the locale/language policy concern for skills that force a specific language without opt-in.
No suspicious patterns detected.
