Volcengine Ata Subtitle

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:13 PM UTC
• Version: 0.1.0

Overview

The skill matches its subtitle-generation purpose, but it can send audio, transcript text, and an API token to any configured endpoint, so users should review it before use.

Install only if you are comfortable sending the selected audio and transcript text to Volcengine/ByteDance infrastructure. Keep VOLC_ATA_API_BASE at the documented HTTPS endpoint, avoid custom endpoints unless you fully trust them, protect any ~/.volcengine_ata.conf file with restrictive permissions, and prefer short-lived or narrowly scoped API tokens. Do not process sensitive recordings until the endpoint validation and upload disclosure gaps are addressed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: volc_ata.py:43

Finding

Unrestricted API Endpoint Can Expose Credentials and Private Media

Content

View full analysis

str: """Submit ATA task to API""" url = f"{self.api_base}{self.submit_path}" payload = { "app": { "appid": self.app_id }, "audio": audio_data, "text": text, "format": format, "language": language } headers = { "Authorization": f"Bearer; {self.token}", "Content-Type": "application/json" } response = requests.post(url, json=payload, headers=headers) response.raise_for_status() result = response.json() return result.get('id') ``` ```python # volc_ata.py:208-221 def _query_task(self, task_id: str) -> Dict[str, Any]: """Query task status""" url = f"{self.api_base}{self.query_path}" payload = { "id": task_id } headers = { "Authorization": f"Bearer; {self.token}", "Content-Type": "application/json" } response = requests.post(url, json=payload, headers=headers) response.raise_for_status() return response.json() ``` ```python # volc_ata.py:277 ...[truncated 3712 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md

## 📦 快速开始
[创建豆包语音应用](https://console.volcengine.com/speech/app)
自动字幕打轴应用，获取APP ID、	Access Token、Secret Key 有20小时试用
<img width="1107" height="761" alt="398d4eed-4abe-497e-96c0-9fd0adae4f39" src="https://github.com/user-attachments/assets/7dfabbe1-b1d7-44e7-b071-007641d0cbad" />

### 安装

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill documentation is entirely in Chinese, including setup and usage instructions, and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking or region-specific audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs users to run a local Python tool that reads environment variables and config files, reads input files, writes subtitle output, and makes outbound network requests, but the manifest declares no explicit tool scope or permissions. That creates an authorization gap: a reviewer or runtime may underestimate the skill's capabilities, increasing the chance that sensitive files, credentials, or network access are granted implicitly without informed approval.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

The skill recommends storing long-lived API credentials in environment variables or a persistent config file under the home directory, including a secret key and access token. Persistent local storage increases the risk of credential leakage through backups, logs, shell history, accidental file exposure, or other skills/processes that can read the user's home directory or environment.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

## Prerequisites

Set the following environment variables or create a config file:

### Option A: Environment Variables

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · volc_ata.py (reported line 55)May include surrounding context.

python

if not self.app_id or not self.token:
            print("⚠️  Warning: ATA credentials not configured")
            print("   Set VOLC_ATA_APP_ID and VOLC_ATA_TOKEN environment variables")
            print("   Or create ~/.volcengine_ata.conf config file")
            print("   Running in demo mode...\n")
    
    def _load_config(self, config_file: str) -> configparser.ConfigParser:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This request submits raw user-provided audio and text to an external network endpoint. In this skill, such transmission is expected functionality, but it is still security-relevant because sensitive content is exfiltrated off-host and the endpoint can be changed via configuration or environment variables, increasing the chance of accidental or unauthorized disclosure.

Content

Scanner excerpt · volc_ata.py (reported line 169)May include surrounding context.

python

"Content-Type": "application/json"
        }
        
        response = requests.post(url, json=payload, headers=headers)
        response.raise_for_status()
        
        result = response.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tool sends the full base64-encoded audio and subtitle text to a third-party API, but the user-facing flow does not provide a clear consent or disclosure warning at the time of transmission. This can expose sensitive media or transcript content to an external service unexpectedly, which is a privacy and data-handling risk even though external transmission is core to the skill's purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

The polling request sends the task identifier and bearer token to an external endpoint. This is less sensitive than the initial upload because it does not resend the full audio/text payload, but it still depends on a configurable remote host and can leak metadata and credentials if redirected to an untrusted API base.

Content

Scanner excerpt · volc_ata.py (reported line 224)May include surrounding context.

python

"Content-Type": "application/json"
        }
        
        response = requests.post(url, json=payload, headers=headers)
        response.raise_for_status()
        
        return response.json()

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The create_subtitle method sets the default language to 'zh-CN', which imposes a specific locale unless the user overrides it. A similar default is also exposed in the CLI, and there is no opt-in flow or justification that this tool is intended only for a China-specific use case.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The command-line argument parser assigns 'zh-CN' as the default language, which forces a specific locale for users who do not specify one. This can violate language/locale policy expectations when no user choice or region-specific justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.