Security audit

视频字幕自动生成器——免费的才是最好的

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local video-processing skill, but users should treat generated transcripts and dependency installation with care.

Install in a virtual environment, prefer pinned dependency versions, and process only media and style files you trust. Check whether Whisper is installed before relying on generated transcripts, because otherwise the tool can generate clearly labeled but synthetic demo subtitles. Keep outputs in a dedicated folder because transcripts and burned-in subtitles may expose sensitive spoken content.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/subtitle_processor.py:139
Finding: FFmpeg Filter-Graph Injection Through Insufficiently Escaped Paths and Style Values
Content: View full analysis
str: """Convert a style dictionary into an ASS format string.""" return ( f"FontName={style['font']}," f"FontSize={style['fontsize']}," f"PrimaryColour={style['primary_color']}," f"OutlineColour={style['outline_color']}," f"BackColour={style['back_color']}," f"Bold={style['bold']}," f"Italic={style['italic']}," f"Underline={style['underline']}," f"StrikeOut={style['strikeout']}," f"BorderStyle={style['border_style']}," f"Outline={style['outline']}," f"Shadow={style['shadow']}," f"Alignment={style['alignment']}," f"MarginL={style['margin_l']}," f"MarginR={style['margin_r']}," f"MarginV={style['margin_v']}," f"Alpha={style['alpha']}" ) ``` `scripts/subtitle_processor.py:195-214`: ```python # FFmpeg on Windows requires forward slashes subtitle_ffmpeg = subtitle_rel.replace("\\", "/") video_ffmpeg = video_rel.replace("\\", "/") output_ffmpeg = output_rel.replace("\\", "/") # Generate style string; special characters in ASS format require escaping style_str = style_to_ass_string(style) style_str_escaped = style_str.replace("\\", "\\\\").replace(":", "\\:").replace(",", "\\,").replace("'", "\\'") # FFmpeg command using the subtitles filter vf_filter = f"subtitles='{subtitle_ffmpeg}':force_style='{style_str_escaped}'" cmd = [ "ffmpeg", "-i", video_ffmpeg, "-vf", vf_filter, "-c:a", "copy", "-y", output_ffmpeg ] ``` `scripts/video_processor.py:352-363`: ```python subtitle_abs = str(Path(subtitle_path).resolve()).replace("\\", "/") video_abs = str(Path(video_p ...[truncated 2754 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:307
Finding: Unpinned Third-Party Dependencies Create a Mutable Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language documentation forces a single language/locale for all instructions and examples, with no indication that the skill is region-specific or that other language options are available. This matches the policy category for language or locale restrictions without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README encourages speech-to-text processing of video audio without warning that uploaded or processed media may contain sensitive personal, confidential, or regulated content. In a media-processing skill, this omission matters because transcripts and extracted audio can create additional copies of sensitive data, increasing exposure and retention risks.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The feature overview presents automatic speech recognition as an implemented capability with Whisper/faster-whisper support. However, later sections explicitly say that without Whisper the program uses simulated output and that the current engine is '模拟模式（演示用）', indicating the documentation overstates the actual implementation.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 119)May include surrounding context.
Linux:

bash
sudo apt install ffmpeg

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 401)May include surrounding context.
Linux:

bash
sudo apt install ffmpeg

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.
Linux:

bash
sudo apt install ffmpeg

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The usage example includes a '--batch' workflow for processing course videos, which implies the capability is currently available. Later sections explicitly list batch processing under future plans and leave it unchecked in the feature checklist, creating a direct contradiction within the documentation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly supports third-party speech recognition engines such as Google and Azure but does not warn that uploaded audio/video content may be transmitted to external services. This creates a real privacy and data-governance risk because users may process sensitive recordings without understanding that their content could leave the local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented workflow generates transcript, subtitle, title, and rendered video files, but the skill does not warn that these outputs may contain sensitive spoken content or derived personal/business information. Users may unintentionally store or redistribute confidential material because the documentation presents output generation as routine without any confidentiality guidance.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/subtitle_processor.py (reported line 220)May include surrounding context.
python
] try: result = subprocess.run( cmd, capture_output=True, timeout=600

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/video_processor.py (reported line 23)May include surrounding context.
python
def check_ffmpeg(): """检查 FFmpeg 是否已安装""" try: result = subprocess.run( ["ffmpeg", "-version"], capture_output=True, text=True,

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/video_processor.py (reported line 63)May include surrounding context.
python
] try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=300, encoding='utf-8') if result.returncode == 0: file_size = Path(output_path).stat().st_size / 1024 / 1024 print(f" ✅ 音频已提取：{output_path} ({file_size:.2f} MB)")

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/video_processor.py (reported line 88)May include surrounding context.
python
] try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=30, encoding='utf-8') if result.returncode == 0: info = json.loads(result.stdout) duration = info.get('format', {}).get('duration', '未知')

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The transcription call hard-codes language="zh", and the recognized text is then automatically converted from Traditional Chinese to Simplified Chinese. This enforces a specific language/locale behavior on all users without offering a choice or documenting user consent, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: When Whisper is unavailable, the script fabricates plausible transcript content and saves it as if it were a real speech-recognition result, then uses it to generate subtitles and titles. This is dangerous because downstream users or systems may trust false content as authentic, enabling integrity failures, misinformation, or accidental publication of fabricated subtitles without clear consent or warning.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/video_processor.py (reported line 238)May include surrounding context.
python
] try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=10, encoding='utf-8') duration = float(result.stdout.strip()) if result.stdout.strip() else 30 except: duration = 30

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 83% confidence
Finding: Although the FFmpeg call avoids shell injection, it embeds attacker-influenced subtitle paths into an FFmpeg filter expression (subtitles='...') with only colon escaping. FFmpeg filter syntax has additional special characters and parsing rules, so crafted file paths can break filter parsing or potentially alter filter behavior, creating an injection-like risk within FFmpeg's own expression language and making hostile media processing more dangerous in this context.
Content: Scanner excerpt · scripts/video_processor.py (reported line 371)May include surrounding context.
python
] try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=600, encoding='utf-8') if result.returncode == 0: file_size = Path(output_path).stat().st_size / 1024 / 1024 print(f" ✅ 视频已生成：{output_path} ({file_size:.2f} MB)")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document includes PowerShell commands that permanently delete files and directories using Remove-Item ... -Recurse -Force without any warning, confirmation step, or backup guidance. Even though the stated purpose is cleanup before packaging, users may copy-paste these commands in the wrong directory or against the wrong paths, causing irreversible local data loss.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file uses a single fixed language throughout, including headings and usage notes, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The overview states that the skill can intelligently refine attractive titles, suggesting a concrete implemented feature. The later configuration section says title style options are '待实现', which contradicts the impression that configurable title generation is already supported.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The README describes subtitle burn-in and output generation but does not clearly warn that the process creates derivative media files and may overwrite or clutter output locations if users reuse paths carelessly. In a video-processing context this is a modest safety issue because users may unintentionally alter workflows around original media or mishandle generated artifacts containing embedded subtitles or sensitive content.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The top-level feature list says users can customize subtitle font, color, size, and position, implying active support. Later, the options section labels subtitle style configuration as '待实现', which directly conflicts with the earlier claim of availability.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The configuration example sets language: "zh" and nearby examples emphasize adding Chinese subtitles, which establishes a default locale preference. The document does not explicitly present this as user-selectable at runtime or justify a Chinese-only default as a region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description states support for Chinese-script conversion features such as simplified/traditional conversion, and the manifest display name and feature text are entirely Chinese, indicating a language-specific experience without any stated user choice or opt-in. Under the policy, locale or language constraints should be explicitly optional or justified when imposed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This JSON manifest/config contains all human-readable comments and the description exclusively in Chinese, with no indication that language choice is optional or that the skill is intended only for a Chinese-speaking context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.