Security audit
Security checks for vulnerabilities and agentic risk
This media-processing skill is mostly purpose-aligned, but it automatically downloads and silently installs an unverified Windows MSI without asking first.
Review before installing. Only use this skill if you are comfortable with it downloading and installing VN Tools CLI from GitHub and downloading some caption models on first use. Prefer a version that asks before installation and verifies the MSI hash and publisher signature.
scripts/vn-tools-cli-install.ps1.txt:89Unverified Remote MSI Is Downloaded and Silently Executed
scripts/vn-tools-cli-install.ps1.txt:22Predictable Temporary MSI Path Permits Package Substitution
The skill advertises fully local, on-device processing and says URLs/cloud files are unsupported, but elsewhere instructs the agent to download installers, Whisper models, and user-provided files. This is a trust-boundary mismatch that can mislead users and downstream systems about network activity and data handling.
The skill instructs the agent to copy and execute a PowerShell installer script using ExecutionPolicy Bypass, and to do so automatically without user confirmation. This introduces arbitrary code execution and system modification behavior unrelated to merely analyzing media files, greatly expanding the attack surface if the bundled script or its supply chain is compromised.
Broad triggers like 'edit video', 'process video', or reusing any referenced local media file can cause the skill to activate for requests outside its intended scope. In this skill, overbroad activation is more dangerous because activation can lead to automatic installation, downloads, and file processing side effects.
The skill says non-local inputs are not supported, but later instructs the agent to download files from URLs or chat attachments into a local working directory and reuse them. Such contradictory guidance can cause the agent to process remote content unexpectedly and undermines safe activation constraints.
The skill directs automatic installation and execution of a local script without a prominent safety warning or explicit consent, despite making persistent system changes. This weakens user awareness and approval for privileged actions, increasing the risk of unsafe execution in environments that assume skills are limited to task-specific processing.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- **No file identified:** If the user requests an action but neither attaches a
file nor mentions a specific file, ask which file to process. If the user
clearly references a previous file (e.g. "compress the video I just sent"),
reuse it without asking.
### 1.4 Command quick reference
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
CLI binary: `& ${vn-tools-cli}` (resolved in § 1.1)
| Command | Required args | Key options |
| ---------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| `extract-audio` | `<video>` | `-o <dir>` `-f mp3` |
| `extract-frame` | `<video>` | `-p first` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| Command | Required args | Key options |
| ---------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| `extract-audio` | `<video>` | `-o <dir>` `-f mp3` |
| `extract-frame` | `<video>` | `-p first` |
| `auto-captions` | `<video>` | `-e <engine>` `-l <lang>` `-j <threads>` `[style flags]` `-o <dir>` |
| `add-caption` | `<video> --srt <srt>` | `--font-family` `--font-size` `--text-color` `--stroke-color` `--stroke-width` `--background-color` `--opacity` `-o <dir>` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| Command | Required args | Key options |
| ---------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| `extract-audio` | `<video>` | `-o <dir>` `-f mp3` |
| `extract-frame` | `<video>` | `-p first` |
| `auto-captions` | `<video>` | `-e <engine>` `-l <lang>` `-j <threads>` `[style flags]` `-o <dir>` |
| `add-caption` | `<video> --srt <srt>` | `--font-family` `--font-size` `--text-color` `--stroke-color` `--stroke-width` `--background-color` `--opacity` `-o <dir>` |
| `compress-video` | `<video>` | `-r <resolution>` `--fps <fps>` `-b <kbps>` `--hdr` `-o <dir>` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| Command | Required args | Key options |
| ---------------- | ------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| `extract-audio` | `<video>` | `-o <dir>` `-f mp3` |
| `extract-frame` | `<video>` | `-p first` |
| `auto-captions` | `<video>` | `-e <engine>` `-l <lang>` `-j <threads>` `[style flags]` `-o <dir>` |
| `add-caption` | `<video> --srt <srt>` | `--font-family` `--font-size` `--text-color` `--stroke-color` `--stroke-width` `--background-color` `--opacity` `-o <dir>` |
| `compress-video` | `<video>` | `-r <resolution>` `--fps <fps>` `-b <kbps>` `--hdr` `-o <dir>` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `auto-captions` | `<video>` | `-e <engine>` `-l <lang>` `-j <threads>` `[style flags]` `-o <dir>` |
| `add-caption` | `<video> --srt <srt>` | `--font-family` `--font-size` `--text-color` `--stroke-color` `--stroke-width` `--background-color` `--opacity` `-o <dir>` |
| `compress-video` | `<video>` | `-r <resolution>` `--fps <fps>` `-b <kbps>` `--hdr` `-o <dir>` |
| `compress-image` | `<image>` | `-f jpeg` |
| `concat-video` | `<video1> <video2> [...]` | `-o <dir>` |
| `denoise` | `<audio \| video>` | |
| `cutout-video` | `<video>` | `--feather <0-100>` `--expand <-20..20>` `-f mp4` |
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
| `compress-video` | `<video>` | `-r <resolution>` `--fps <fps>` `-b <kbps>` `--hdr` `-o <dir>` |
| `compress-image` | `<image>` | `-f jpeg` |
| `concat-video` | `<video1> <video2> [...]` | `-o <dir>` |
| `denoise` | `<audio \| video>` | |
| `cutout-video` | `<video>` | `--feather <0-100>` `--expand <-20..20>` `-f mp4` |
The skill presents itself as a local tool with no cloud/API requirements, yet it depends on network downloads for software installation and Whisper model retrieval. While not inherently malicious, this hidden network dependency can surprise users, fail in restricted environments, and create supply-chain exposure.
The documentation states that all processing runs locally and implies no cloud/network involvement, but the auto-captions feature requires one-time downloads for several Whisper engines. This can mislead users operating in offline, restricted, or privacy-sensitive environments into invoking a command that unexpectedly makes network requests, violating deployment assumptions and potentially exposing metadata such as IP address or download activity.
The script downloads an MSI from GitHub at runtime even though the skill is described as local-only processing with no cloud/API dependency. This creates a supply-chain and transparency risk: users or downstream systems may trust the skill as purely local while it performs network retrieval and executes newly downloaded software without any integrity verification such as a pinned hash or signature check.
The script silently installs software via msiexec using a downloaded MSI, which expands the skill from media processing into code acquisition and execution on the host. In this context, that is security-relevant because installation is a privileged persistence-enabling action and, if the download source or release artifact is compromised, it can lead to arbitrary code execution under the user context.