Security audit
Security checks for vulnerabilities and agentic risk
The skill appears intended for transcription and bilingual subtitle generation, but it uses unsafe generated-code execution and automatic dependency/model downloads that deserve review before installation.
Install only if you are comfortable with the skill running local shell commands, creating subtitle working files, downloading Whisper models, and potentially installing faster-whisper from package infrastructure. Review or change the generated-translation step so it writes JSON directly instead of executing a generated Python file, and require explicit approval before any dependency installation.
Although the core mismatch claim may be overstated, the skill does omit meaningful runtime behavior: automatic pip installation and use of a HuggingFace mirror endpoint. Undisclosed network access and package installation expand the attack surface and can surprise users or agents operating under stricter trust assumptions.
Although the core mismatch claim may be overstated, the skill does omit meaningful runtime behavior: automatic pip installation and use of a HuggingFace mirror endpoint. Undisclosed network access and package installation expand the attack surface and can surprise users or agents operating under stricter trust assumptions.
Although the core mismatch claim may be overstated, the skill does omit meaningful runtime behavior: automatic pip installation and use of a HuggingFace mirror endpoint. Undisclosed network access and package installation expand the attack surface and can surprise users or agents operating under stricter trust assumptions.
Although the core mismatch claim may be overstated, the skill does omit meaningful runtime behavior: automatic pip installation and use of a HuggingFace mirror endpoint. Undisclosed network access and package installation expand the attack surface and can surprise users or agents operating under stricter trust assumptions.
The skill instructs the agent to generate and execute a Python script from subtitle/translation content, creating an unnecessary code-execution step in a workflow that should only serialize data. If untrusted transcript or translation text is embedded into executable Python source, crafted content can break out of string context or otherwise turn data handling into arbitrary code execution.
The script invokes a shell to run pip at runtime using os.system, which introduces command-execution risk and performs a networked dependency change during normal use. Even though the interpolated value is sys.executable rather than direct user input, shell invocation plus implicit package installation can be abused in compromised environments and violates least surprise for a transcription tool.
from faster_whisper import WhisperModel
except ImportError:
print("正在安装 faster-whisper...", file=sys.stderr)
os.system(f"{sys.executable} -m pip install faster-whisper -q")
from faster_whisper import WhisperModel
audio = Path(audio_path)
The skill clearly instructs use of shell commands, file reads/writes, environment variables, and dependency installation, but it declares no explicit tool scope or permissions. That increases the chance an agent will execute broader capabilities than users expect, reducing containment and auditability.
Broad triggers like '转录', 'subtitle', and '语音转文字' can match many ordinary conversations, causing the skill to activate in contexts where users did not intend file operations, shell execution, dependency installation, or network downloads. Overbroad activation increases the chance of accidental tool use and unsafe automation.
The skill writes multiple output files, creates working directories, and may persist intermediate artifacts without prominently warning the user in the description. Hidden filesystem side effects can expose sensitive media-derived text, create clutter, or cause agents to modify directories users did not expect.
The docstring, comments, status output, and usage message are written in Chinese throughout the script. This imposes a specific language on users without opt-in or any indication that the skill is intended only for a Chinese-speaking or region-specific context, which matches the language/locale policy violation criteria.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
]
print(f"正在提取音频：{video.name}")
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode != 0:
print(f"错误：ffmpeg 执行失败：\n{result.stderr}", file=sys.stderr)
The manifest describes the skill as supporting '双语字幕生成' (bilingual subtitle generation), but the implemented logic only transcribes audio and writes one SRT file containing the original recognized text. There is no translation step, no second language track, and no bilingual subtitle composition in this file.
Automatically installing packages at runtime is outside the expected scope of a transcription script and causes unreviewed code retrieval and execution from external package infrastructure. In the skill context, this is more dangerous because the tool processes local files and users may run it in trusted environments expecting only offline transcription behavior.
The script executes an installation command after only a generic status message, without explicit warning, confirmation, or disclosure of the security implications. This reduces user awareness and can lead to silent execution of network-dependent code changes in environments where package provenance, mirrors, or indexes may be untrusted.
This code file contains docstrings, usage text, status messages, and error reporting entirely in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a locale policy issue because users are not given any alternative language or configuration choice.
No suspicious patterns detected.