Media Inspector

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:23 AM UTC
• Version: 1.0.0

Overview

This skill performs local media scanning and transcription as advertised, with caution needed around optional Whisper installation and saved transcript reports.

Install the optional Whisper dependency only from a source and package name you trust, preferably pinned to a known version. Treat generated reports and `whisper_raw` outputs as potentially sensitive because they can contain transcript text from local media; write them to a private directory and delete them when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:46

Finding

Ambiguous and Unpinned Whisper Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:46-50
Vulnerability Type: Unpinned and ambiguously named third-party dependency
Risk Level: Medium

Vulnerable Code Snippet

bash

# Optional: Whisper speech-to-text
pip install whisper
# Or
brew install whisper

The Python implementation subsequently imports the package without verifying its identity or version:

python

try:
    import whisper  # type: ignore
    return True, "python"
except Exception:
    return False, ""

It later loads and executes functionality supplied by that package:

python

import whisper  # type: ignore
model = whisper.load_model("base")
result = model.transcribe(str(path))

Technical Analysis

The documentation instructs users to run pip install whisper without specifying an audited version, package hash, lockfile, or trusted source. The package name is also ambiguous and does not clearly identify the intended OpenAI Whisper distribution.

Python packages may execute build-backend or installation code during installation. Their module initialization and model-loading methods also execute with the privileges of the user running the analyzer. Consequently, an unintended, compromised, or dependency-confused package could execute arbitrary code when installed or imported.

The analyzer does not validate the imported module's distribution name, version, source path, or integrity before calling whisper.load_model() and processing user-selected media.

Attack Path

1. A user follows the installation instructions and runs pip install whisper.
2. The configured Python package index resolves the ambiguous, unpinned name to an unintended or compromised release.
3. Malicious code can execute through package installation hooks.
4. When scripts/analyze_media.py runs, it imports whisper at lines 39 or 62.
5. The analyzer invokes package-controlled load_model() and transcribe() functionality.
6. The malicious dependency executes with the cu ...[truncated 778 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the ambiguous package instruction with the exact intended distribution, such as an explicitly verified openai-whisper release.
2. Pin the dependency to a reviewed version instead of accepting the latest available release.
3. Provide a lockfile or requirements file containing cryptographic hashes, and install with hash verification:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Document the approved package repository and avoid untrusted or fallback package indexes.
5. Verify the installed distribution name and version at runtime before importing it.
6. Validate that the imported module originates from the expected environment and installation path.
7. Pin and verify any model artifact downloaded by whisper.load_model("base"), including its source and checksum.
8. Run transcription in an isolated, least-privileged environment without unnecessary credentials or access to unrelated user files.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述了一个较完整的本地音视频分析工具，包含扫描、元数据提取、语音转写、摘要和关键片段生成等能力。但提供的代码块实际只实现了媒体文件扫描与基础信息汇总：识别媒体文件、用 ffprobe 获取简单流/时长信息、读取文件大小与修改时间，并生成报告文件。代码中没有任何 Whisper 调用、转写逻辑、摘要逻辑、关键片段检测或导出逻辑。因此，代码行为明显少于声明能力，属于描述与实际行为不符。未发现额外的越权或无关外部行为；不匹配主要在于声明的核心能力大部分未在代码中实现。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description and main skill introduction are written only in Chinese, which effectively forces a specific language for users without any opt-in or alternative locale support. Under the policy, language constraints should either be optional for the user or clearly documented as a justified region-specific limitation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_media.py (reported line 18)May include surrounding context.

python

def run_ffprobe(path: Path) -> Dict[str, Any]:
    cmd = ["ffprobe", "-v", "error", "-print_format", "json", "-show_format", "-show_streams", str(path)]
    out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True)
    return json.loads(out)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/scan_media.py (reported line 41)May include surrounding context.

python

def run_ffprobe(path: Path) -> Dict[str, Any]:
    cmd = ["ffprobe", "-v", "error", "-print_format", "json", "-show_format", "-show_streams", str(path)]
    out = subprocess.check_output(cmd, stderr=subprocess.STDOUT, text=True)
    return json.loads(out)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_media.py (reported line 54)May include surrounding context.

python

"--output_format", "json",
        "--output_dir", str(txt_dir),
    ]
    subprocess.check_call(cmd)
    json_path = txt_dir / f"{path.stem}.json"
    if not json_path.exists():
        return None

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The tool writes transcript text, summaries, and key excerpts derived from local media into JSON, CSV, and Markdown reports without any explicit warning, consent step, or opt-in control. Because media often contains sensitive spoken content or personal data, this behavior can create inadvertent data-at-rest exposure, especially on shared systems, synced folders, or environments with broad file access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is written only in Chinese, which can impose a language choice on users without offering an alternative or documenting that the skill is intended for a Chinese-only audience. This matches the language/locale policy concern for natural-language content applicable to all file types.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.