T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:44- Finding
Unconfirmed Persistent Storage of Inferred User Preferences
- Content
View full analysis
- Remediation
View remediation
Security audit
video-transcript-pro
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Chinese video-transcription helper, but it automatically searches the web and saves preferences across sessions without clear opt-in or deletion controls.
Review before installing if you handle confidential audio or video. Use it only with content you are comfortable having summarized into local files and potentially queried through web search, ask the agent to disable web enrichment and MEMORY.md preference storage for sensitive work, and install dependencies in an isolated environment with a reviewed faster-whisper version.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
README.md:20- Finding
Unpinned and Incorrectly Documented Python Dependency
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly states that the skill will perform '联网知识补充：自动搜索专业术语' without warning the user that transcript content, inferred topics, or extracted terms may be sent to external services. Because transcripts may contain sensitive business, personal, or confidential material, automatic online search can cause unintended data disclosure to third parties.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger conditions are broad enough to match common phrases like converting media to text or making platform articles, which can cause the skill to activate in situations the user did not clearly intend. Over-broad triggering is risky here because the skill can then proceed into automatic transcription, network access, and persistence behaviors.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill auto-continues after 3 minutes of no response using inferred information, yet it does not provide a clear privacy notice about data persistence or downstream processing. Silence is treated as consent for actions that may include content transformation and later memory use, which is unsafe for potentially sensitive media workflows.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill explicitly uses persistent memory (
MEMORY.md) to store and reuse user preferences across sessions, but this persistence is not narrowly scoped to the immediate transcription task and lacks consent, retention, or minimization controls. This creates a privacy and data-governance risk because user history may be accumulated and silently reused in future interactions.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Persistent storage of user preference/history data for automatic reuse is a direct data minimization and privacy concern when the scope, retention, and necessity are not defined. Because the skill handles media-derived content and inferred audience/style preferences, accumulated memory can expose patterns about the user over time.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
默认设置直接指定“语言：中文（zh）”，属于语言/locale 的预设强制行为。文档未说明该技能仅面向中文内容，也未提供用户选择其他语言或自动检测语言的选项，不符合需有用户选择或清晰限定的要求。
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill directs the agent to automatically perform network research (
web_search/web_fetch) to enrich transcript content, which expands behavior beyond local transcription/editing and may transmit sensitive terms or context to external services without explicit approval. In a workflow that may process private audio/video, automatic outbound access increases confidentiality and provenance risks.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instruction to record user preferences into
MEMORY.mdfor future reuse establishes persistent storage of personal behavior/preferences without any visible consent or lifecycle controls. This is dangerous because it can create silent profiling and long-term retention of potentially sensitive user data unrelated to a single transcription job.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill specifically tells the agent to save user preferences into
MEMORY.mdfor future sessions, creating durable state without transparent user control. This increases the risk of unauthorized retention, cross-session profiling, and accidental reuse of stale or sensitive preferences.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The package description is entirely in Chinese and describes outputs for Chinese platforms, which indicates a language/locale constraint in the skill's natural-language metadata. There is no indication that users can opt into another language or that the restriction is explicitly justified as a region-specific skill.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module docstring states this is a 'segmented transcription script' for transcribing long videos in segments, and the usage text advertises a segment length parameter. However, the implemented main flow at L228-L229 unconditionally calls transcribe_full() and never invokes transcribe_segment(), so the documented intent directly contradicts actual behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module docstring, usage text, and later user-facing messages are written entirely in Chinese, which imposes a specific language on all users. The policy allows locale constraints only when they are optional or clearly justified, but this file provides no opt-in, alternative locale, or stated regional limitation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The docstring states the default language is 'zh', and the CLI implementation also defaults the language argument to 'zh'. This imposes a specific language/locale behavior by default rather than offering a neutral default such as auto-detection or explicit user choice.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill documents multiple generated output files but does not tell users where those files will be written, whether they persist after execution, or how long they are retained. Transcript and derivative content often contain sensitive information, so silent local storage can expose data to other users, backups, syncing services, or later unintended access.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Automatic web access is disclosed as part of the workflow but not framed with a user warning that content-derived terms may be sent to external sources. While the immediate effect is limited to enrichment, it still creates avoidable privacy and trust risks in a media-processing skill.
- Content