maple-video2article

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:10 PM UTC
• Version: 1.0.5

Overview

The skill’s video-to-article workflow is mostly coherent, but its downloader can automatically merge and delete unrelated media files in the chosen output folder.

Install only if you are comfortable with the skill downloading remote videos, installing media/transcription dependencies, and writing large local outputs. Use a fresh empty output directory for each download because the current downloader has unsafe cleanup behavior that may delete unrelated audio/media files in that directory. Prefer an isolated Python environment with pinned dependencies before running it on private or important media.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/video_downloader.py:143

Finding

Unrelated Media Files Can Be Merged and Deleted

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/video-to-txt使用说明/requirements.txt:1

Finding

Third-Party Python Dependencies Are Not Reproducibly Pinned

Content

View full analysis

=1.1.0 av>=12.0.0 opencc-python-reimplemented>=0.1.7 ``` The documented installation command in `references/video-to-txt使用说明/video2txt使用说明.md` installs these dependencies directly: ```text python -m pip install -r requirements.txt ``` ### Technical Analysis The dependency declarations use lower-bound constraints rather than exact reviewed versions. No lock file or cryptographic hashes are supplied. Consequently, installations performed at different times can resolve to different direct or transitive package versions. Python package installation may execute package build or installation logic, while imported packages execute with the privileges of the application process. If a future permitted release or one of its transitive dependencies is compromised, the Skill can install and execute code that was not present during this audit. This finding does not establish that the currently named packages are malicious. The risk arises from allowing unreviewed future artifacts and dependency graphs to satisfy the installation specification. ### Attack Path 1. A future package version satisfying one of the `>=` constraints, or a permitted transitive dependency version, becomes compromised. 2. A user follows the documented installation command. 3. The package resolver selects the compromised version because no exact version or hash restricts it. 4. Package installation or subsequent import executes attacker-controlled code under the invoking user's account. 5. That code receives access to the files, network resources, environment variables, and other resources available to that account. ### Impact Assessment Exploitation would execute code with the privileges of the user performing installation or running the Skill. In a standard ...[truncated 411 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

该代码块的核心功能是一个视频下载器，而不是“从视频生成图文并排文章”的完整流水线。它支持从 URL 下载视频、选择格式与分辨率、通过 ffmpeg 检测和合并音视频流，并做文件名清理；但没有任何与语音识别、OCR、字幕提取、关键帧抽取、图文排版、Markdown 生成或时间轴对齐相关的实现。声明中提到支持本地视频文件与在线视频 URL 的完整文章生成流程，而本代码仅覆盖其中很小的一部分（URL 下载），且主要目的与声明的主要用途存在实质差异，因此应判定为描述与实际行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

该代码块的核心功能非常明确：接收本地视频文件路径，使用 OpenCV 定时截帧，支持相似帧过滤，保存图片并输出 JSON 清单。它没有任何网络下载逻辑、没有处理 URL、没有音视频文本提取、没有时间轴对齐、也没有 Markdown/文章生成逻辑。因此，代码实际行为仅覆盖声明中的“视频帧截取”这一子步骤，且输入范围也比声明更窄（仅本地文件，不支持在线视频 URL）。这属于对主要用途的重大不一致，应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

声明描述的是一个完整的视频转文章流水线工具，而代码内容是一个转写脚本。它验证本地文件路径和后缀，加载 faster-whisper 模型，对本地音视频做语音识别，输出 .srt 和 .txt 文件，并打印检测语言等信息。支持的输入虽然包含常见视频/音频格式，但参数 --input 明确要求本地文件路径，代码也仅检查文件是否存在，不支持 URL。代码中没有任何网络下载、视频帧抽取、图像处理、Markdown 生成、文章组织编写或图文并排排版逻辑。因此，声明用途与实际行为存在明显且实质性的偏差。

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/video-to-txt使用说明/video2txt使用说明.md (reported line 3)May include surrounding context.

md

---
name: video2txt
description: 将本地视频或音频文件转写为 SRT 字幕文件和 TXT 纯文本文件
metadata: { "openclaw": { "emoji": "video", "requires": { "bins": ["python3"] } } }
---

# video2txt 技能

## 描述

将本地视频或音频文件转写为 SRT 字幕文件和 TXT 纯文本文件。

## 功能

- 提取视频/音频中的语音内容
- 生成带时间戳的 SRT 字幕文件
- 生成纯文本 TXT 文件
- 支持多种视频和音频格式
- 默认使用中文识别，自动转换为简体中文

​	使用场景：

1. 需要读取视频内容或理解视频时

## 使用方法

###

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/video-to-txt使用说明/video2txt使用说明.md (reported line 21)May include surrounding context.

md

- 支持多种视频和音频格式
- 默认使用中文识别，自动转换为简体中文

​	使用场景：

1. 需要读取视频内容或理解视频时

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest promises generating a markdown article with side-by-side images and text, support for online video URLs with automatic download, frame extraction, timeline matching, and article writing. This file's CLI and logic only accept a local file path, run speech transcription, and emit .srt and .txt outputs, which is a materially narrower behavior than the advertised end-to-end article-generation workflow.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to read local files, write outputs, invoke Python, and potentially download remote content, but it declares no explicit tool scope or permission boundaries. That increases the blast radius of prompt injection or operator error because the runtime may permit broader shell/filesystem/network actions than the user expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill describes downloading remote videos and writing them to disk, but it does not prominently warn about network access, storage consumption, retention, or privacy implications. This is risky because users may provide third-party URLs or sensitive media without understanding that content will be fetched, stored locally, and processed through multiple steps.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger scenarios are broad enough to overlap with ordinary requests about summarizing or understanding videos, which can cause accidental invocation of a skill that performs downloads, shell commands, and file writes. In an agent environment, overbroad activation is dangerous because it can escalate a harmless conversation into local processing and network activity without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

L084 将转写命令固定为“--language zh”，而整份技能说明未说明这是可选参数，也未给出让用户选择语言的机制。这会对非中文视频或希望使用其他语言输出的用户施加默认语言限制，属于未获用户明确选择的语言/locale 约束。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The provided file's front matter and body consistently claim the skill only converts local video/audio into SRT and TXT outputs. That is materially narrower and different from the stated skill manifest context, which promises downloading online videos, extracting frames, aligning timelines, and composing a Markdown article with side-by-side images and text.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation states that the skill '默认使用中文识别，自动转换为简体中文', which imposes a specific language and script normalization by default. This is a natural-language locale policy concern because the user is not clearly offered an explicit opt-in choice before forcing Chinese recognition and Simplified Chinese conversion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring, CLI help text, and runtime messages are written exclusively in Chinese, which imposes a specific language on users. Under the policy, locale constraints should either offer user choice or be clearly documented as region-specific and justified, which is not present here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring explicitly describes downloading videos from arbitrary platforms such as YouTube, B站, and 抖音, with its own CLI usage focused on download resolution and output directory. The manifest describes an end-to-end video-to-article workflow where online URL download is only an input-acquisition detail, not a primary downloader capability exposed as a separate tool concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This Python file includes user-facing natural-language description, usage text, and examples entirely in Chinese, which imposes a language/locale choice on users. The policy specifically prohibits forcing a specific language without user opt-in, and there is no indication that this skill is region-specific or that other languages are supported.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The code shells out to yt_dlp via Python module invocation and to ffmpeg/ffprobe binaries for stream inspection and merging. For a skill described as generating a markdown article from video, network retrieval of a URL is expected, but spawning external media-processing executables is a stronger capability that is not disclosed in the stated purpose.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_downloader.py (reported line 96)May include surrounding context.

python

def has_audio_stream(filepath):
    """检测文件是否有音频流（用 ffmpeg -i 输出判断）"""
    try:
        result = subprocess.run(
            [FFMPEG, '-i', filepath, '-hide_banner'],
            capture_output=True, text=True, timeout=15,
            encoding='utf-8', errors='replace'

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_downloader.py (reported line 109)May include surrounding context.

python

def has_audio_stream(filepath):
    """检测文件是否有音频流（用 ffmpeg -i 输出判断）"""
    try:
        result = subprocess.run(
            [FFMPEG, '-i', filepath, '-hide_banner'],
            capture_output=True, text=True, timeout=15,
            encoding='utf-8', errors='replace'

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_downloader.py (reported line 164)May include surrounding context.

python

cmd = [FFMPEG, '-y', '-i', vid_file, '-i', aud_file,
                   '-c:v', 'copy', '-c:a', 'aac', merged_path]
            try:
                result = subprocess.run(cmd, capture_output=True, text=True, 
                                       timeout=120, encoding='utf-8', errors='replace')
                if os.path.exists(merged_path):
                    # 合并成功，删除临时文件

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_downloader.py (reported line 197)May include surrounding context.

python

list_cmd = YT_DLP_CMD + ['-F', '--no-warnings', url]
    try:
        result = subprocess.run(list_cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, 
                                text=True, timeout=30, encoding='utf-8', errors='replace')
        if result.returncode != 0:
            raise Exception(result.stderr)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_downloader.py (reported line 270)May include surrounding context.

python

]

    try:
        result = subprocess.run(download_cmd, capture_output=True, text=True, timeout=600, encoding='utf-8')
        if result.returncode != 0:
            raise Exception(result.stderr or result.stdout)
    except subprocess.CalledProcessError as e:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

DEFAULT_LANGUAGE is set to zh, and the CLI help states that recognition defaults to Chinese unless the user explicitly changes it. This imposes a specific language/locale choice by default, which matches the policy-violation category for forced language behavior without opt-in.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_to_text.py (reported line 136)May include surrounding context.

python

str(file_path),
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0 and result.stdout.strip():
            return float(result.stdout.strip())
    except Exception:

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest/documentation for the skill states it supports local video files or online video URLs with automatic download. In contrast, the argparse description and --input help explicitly describe only a local video/audio file path, which directly conflicts with the higher-level documented intent for the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file describes that the script saves extracted frames and additionally generates result.json in the output directory, but it presents this as behavior documentation rather than a user-facing caution about filesystem impact. Because the skill can create a potentially large number of files and modify the target directory, a brief warning about disk usage and directory contents would improve user disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.