Web Video Transcribe DOCX

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:23 AM UTC
• Version: 1.0.2

Overview

The skill mostly does what it claims, but it installs unpinned runtime packages and downloads/extracts a remote model without strong integrity checks, so users should review it before installing.

Review before installing in a sensitive environment. Use a virtual environment, pin and verify dependencies, prefer a preverified local model directory where possible, and treat media_info.json as private because it may contain reusable media URLs and Referer/Origin context.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: scripts/bootstrap_env.py:10

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/pipeline_common.py:53

Finding

SenseVoice Model Archive Downloaded Without Integrity Verification

Content

View full analysis

Path: root = target_root or cache_root() root.mkdir(parents=True, exist_ok=True) model_dir = root / MODEL_DIR_NAME model_file = model_dir / "model.int8.onnx" tokens_file = model_dir / "tokens.txt" if model_file.is_file() and tokens_file.is_file(): return model_dir archive_path = root / MODEL_ARCHIVE_NAME if not archive_path.is_file(): download_file(MODEL_URL, archive_path) _safe_extract_tar(archive_path, root) if not model_file.is_file() or not tokens_file.is_file(): raise RuntimeError("SenseVoice model download completed, but required files are missing.") return model_dir ``` ### Technical Analysis The Skill downloads a model archive from a fixed HTTPS GitHub URL, but it does not compare the archive against a pinned SHA-256 digest or verify a cryptographic signature. HTTPS protects transport under normal conditions but does not establish that the retrieved artifact is the exact artifact reviewed by the Skill author. The code also trusts any pre-existing archive at the cache path. A corrupted, partially downloaded, or locally replaced archive is therefore reused without validation. The extracted ONNX model is subsequently parsed by `sherpa_onnx`, placing the ONNX and archive parsers in the trust boundary. This behavior is operationally related to the declared transcription function, but the integrity controls are insufficient for a remotely retr ...[truncated 1319 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pipeline_common.py:184

Finding

Archive Extraction Does Not Reject Symbolic or Hard Links

Content

View full analysis

None: destination = destination.resolve() with tarfile.open(archive, "r:*") as tar: members = tar.getmembers() for member in members: target = (destination / member.name).resolve() if not str(target).startswith(str(destination)): raise RuntimeError(f"Unsafe tar member path: {member.name}") tar.extractall(destination) ``` ### Technical Analysis The function checks member names for direct path traversal, but it does not reject symbolic links, hard links, device entries, or other special archive members. It also does not validate link targets. A malicious archive may first create a link inside the destination that points outside the model cache and then extract content through that link. Whether a particular construction succeeds can depend on the Python version and `tarfile` implementation behavior, but the code does not explicitly enforce the intended boundary. The string-prefix comparison is also weaker than a path-aware containment test. For example, paths sharing the destination's textual prefix are not necessarily descendants of that directory. The absence of explicit member-type restrictions becomes more significant because the archive is remotely downloaded without cryptographic integrity verification. ### Attack Path 1. An attacker substitutes the remotely downloaded model archive or places a crafted archive in the writable cache under the expected filename. 2. The archive contains a symbolic or hard-link entry whose target is outside the intended cache directory. 3. A subsequent archive member writes content through or into the crafted link. 4. `_safe_extract_tar()` validates only the resolved member-name p ...[truncated 886 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The main mismatch is scope. The description presents a general-purpose workflow for arbitrary web pages, with Toutiao as just one special case. This code explicitly rejects non-Toutiao page URLs and tells the user to capture a direct media URL first, so page extraction is not generic. The code does support direct media URLs and local transcription to TXT/DOCX, which aligns with part of the description, and it uses helper functions consistent with downloading media and transcribing. However, the declared capability to extract from arbitrary web pages, including various stream types, is not represented in this chunk. Also, the described cleaning/chapterization step is absent here. Therefore the description materially overstates what this specific skill code does.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

### 5. Stay within scope

- Only download URLs that the user supplied directly or that the extractor captured from the target page.
- Do not request, store, or exfiltrate cookies, access tokens, or account credentials.
- Do not attempt to bypass DRM, login walls, or geo-restriction controls.
- If a page requires authenticated browser state that is not already available, say so plainly and stop at the supported boundary.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/workflow.md (reported line 80)May include surrounding context.

md

If it cannot find a browser, install Chrome or Edge, or extend the script for the local environment.

## Output rules

- Keep the raw transcript and the refined transcript as separate files.
- Use raw transcript files for auditability.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises and instructs use of sensitive capabilities including shell execution, filesystem access, network access, and browser-driven extraction, but it does not declare any explicit tool scope or permissions boundary. In an agent marketplace or automation environment, this increases the risk of overbroad execution because operators and policy layers cannot easily constrain what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill metadata strongly frames output as Chinese transcription/cleaned Chinese text without making language choice explicit. While not a classic security flaw, this can cause the system to override user expectations, mishandle non-Chinese content, or apply the skill to requests where language handling should be user-directed, increasing the chance of incorrect processing and unintended disclosure in multilingual contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The default prompt uses broad, trigger-like phrasing ('Use $web-video-transcribe-docx to...') that can cause the skill to be invoked in situations where the user did not explicitly request this specific workflow. Because the skill performs powerful actions such as extracting media from arbitrary web pages and producing deliverables, accidental activation could lead to unnecessary network access, unintended processing of content, or overreach beyond user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow explicitly instructs users to pass and preserve request headers such as Referer and Origin when downloading media, but it provides no warning that captured headers or related request metadata can contain sensitive information or reveal browsing context. In a media-extraction skill, this creates a realistic risk of unintentionally storing or sharing sensitive request details in output artifacts or logs, especially when users generalize the pattern to authenticated pages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to preserve media_info.json for later retries encourages retention of extracted media URLs and headers without noting that those artifacts may embed sensitive request metadata, internal URLs, or account-linked identifiers. Because this skill is designed to capture browser-observed media requests from arbitrary pages, the context makes silent retention of metadata more dangerous than in a purely local-only workflow.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/bootstrap_env.py (reported line 39)May include surrounding context.

python

missing = missing_packages()
    if missing:
        subprocess.run([sys.executable, "-m", "pip", "install", *missing], check=True)
    else:
        print("All required Python packages are already installed.")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script automatically installs missing Python packages as soon as it is executed, without an explicit runtime confirmation step. In a skill that handles arbitrary web media workflows, this increases supply-chain and environment-modification risk because executing the helper causes immediate network retrieval and installation of executable third-party code.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/bootstrap_env.py (reported line 44)May include surrounding context.

python

print("All required Python packages are already installed.")

    if args.install_playwright_browser:
        subprocess.run([sys.executable, "-m", "playwright", "install", "chromium"], check=True)

    print("Environment bootstrap complete.")
    return 0

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script passively captures request and response metadata from a browser session and exports selected request headers to JSON alongside discovered media URLs. Even if sanitize_captured_headers() removes some sensitive fields, this workflow can still persist session-linked headers such as Referer, Origin, or other tokens that may disclose browsing context or enable reuse against protected media endpoints, and there is no explicit user warning or consent prompt before recording them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script passively captures request and response metadata from arbitrary web pages, then persists selected headers and media URLs to stdout or a JSON file without any explicit warning, consent gate, or redaction guarantee visible in this file. In this skill’s context, captured headers such as Referer, Origin, cookies, authorization-like values, or signed playback tokens may expose session context or reusable access parameters, making local persistence and later reuse more sensitive than ordinary scraping.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/pipeline_common.py (reported line 85)May include surrounding context.

python

def run_ffmpeg(args: list[str]) -> None:
    cmd = [ffmpeg_executable(), "-nostdin", "-y", "-v", "error", *args]
    subprocess.run(cmd, check=True)


def guess_suffix_from_url(url: str) -> str:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The function automatically downloads a model archive from the network and extracts it into a local cache without any authenticity verification such as a pinned checksum or signature. Although path traversal is mitigated by the extraction check, a compromised upstream release, MITM in a misconfigured environment, or poisoned cache could lead to execution of untrusted model assets in downstream tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This path forwards captured headers to ffmpeg for remote manifest retrieval, which can disclose request metadata to attacker-controlled URLs and trigger ffmpeg's network stack on untrusted inputs. In this skill context, arbitrary web-page media extraction makes SSRF-style internal network access or sensitive header leakage more plausible if the source URL or captured headers are attacker influenced.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The argument parser sets --language to default to zh, which imposes a specific language/locale choice unless the user explicitly overrides it. The policy allows locale constraints only when the user is given a choice up front or the constraint is clearly documented and justified; here the default silently prefers Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction specifies chapter headings using the Japanese form ## 第1章 ..., which imposes a particular language/locale convention. The file does not indicate that Japanese output is optional, user-selected, or required by a region-specific use case.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file includes commands for a real smoke test that generate TXT and DOCX outputs under an output directory, but the surrounding instructions do not explicitly warn the user that running them will create files on disk. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or system state.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example command hard-codes the document title as 视频章节整理稿, which imposes a specific language in user-facing output. The workflow does not indicate that the skill is region-specific or offer an option to choose the output language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

When the optional flag is supplied, the script launches a subprocess to install Chromium via Playwright, which changes the local system state and may download substantial external artifacts. The code includes argparse help text, but no explicit runtime disclosure or confirmation is shown when this action actually occurs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The function performs a network request and sends headers such as User-Agent and optionally captured Origin/Referer values, but there is no confirmation prompt, log message, or explanatory comment/docstring warning that outbound requests will transmit metadata. In this file, the behavior is not disclosed to the user at the point of execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

When the output directory already exists, the function unlinks matching part_*.wav files before generating new segments, but there is no confirmation, visible log message, or explanatory comment warning about this deletion behavior. Users may not realize prior outputs will be removed as a side effect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The function signature sets the default language to "zh", which means the skill implicitly prefers a specific language/locale when the caller does not choose one. The policy allows locale constraints when they are clearly justified or user-selected, but this code applies the preference automatically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.