Security audit

video2imgs-视频关键帧获取

Security checks for vulnerabilities and agentic risk

Overview

The skill does the advertised video frame extraction, but it quietly prioritizes a hardcoded external dependency folder that could cause the wrong Python module to run.

Review before installing. Use an isolated virtual environment, pin and hash dependencies, and remove or explicitly control the hardcoded D:\SOFTware\py_dependent import path before running the skill on sensitive machines or untrusted videos. Avoid reusing an output directory that may contain files with colliding frame names unless overwrites are acceptable.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/video_frame_capture.py:8
Finding: External Dependency Search-Path Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Third-Party Dependencies Permit Unreviewed Package Updates
Content: View full analysis
=4.5.0 numpy>=1.21.0 ``` The documented installation instruction in `SKILL.md` directs users to install these mutable requirements: ```text pip install -r requirements.txt ``` ### Technical Analysis Both dependencies use open-ended minimum-version constraints. Consequently, separate installations can resolve to different package versions, including future releases that were unavailable and unreviewed when the skill was audited. The requirements file also lacks cryptographic hashes and does not lock transitive dependencies. Package installation may execute package build or installation logic, so the security of the skill installation depends on whatever artifacts the package index supplies at installation time. This issue does not establish that the named packages are currently malicious. It creates a supply-chain exposure by allowing reviewed dependencies to change without a corresponding source update or audit. ### Attack Path 1. A user follows the documented command `pip install -r requirements.txt`. 2. The package resolver queries the configured package index and selects any versions satisfying the open-ended `>=` constraints. 3. A future compromised, malicious, or unexpectedly incompatible release satisfies those constraints. 4. The installer downloads and installs that unreviewed artifact. 5. Any package lifecycle code runs with the privileges of the user performing installation; imported package code can later run when the frame-capture script loads OpenCV. ### Impact Assessment If a selected dependency artifact is compromised, installation or later import could execute code with the installing or invoking user's privileges. Potential scope includes the active Python environment, project files, accessible user data, envi ...[truncated 261 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/video_frame_capture.py:125
Finding: Deterministic Output Writes Can Silently Overwrite Existing Files
Content: View full analysis
None: suffix = ".jpg" if image_extension == "jpg" else ".png" ok, encoded = cv2_module.imencode(suffix, frame) if not ok: raise RuntimeError(f"Failed to encode frame image: {output_path}") output_path.write_bytes(encoded.tobytes()) ``` The destination is generated deterministically and written without checking whether it already exists: ```python output_name = build_output_name(video_stem, timestamp_seconds, stats.attempted, image_extension) output_path = output_dir / output_name write_image(output_path, frame, image_extension, cv2) ``` ### Technical Analysis `Path.write_bytes()` opens the destination for writing and truncates an existing file. Output names are derived from the input video's stem, timestamp, capture index, and selected extension. Repeating a capture with the same video stem, interval, and output directory can therefore generate identical paths. No existence check, exclusive-create operation, confirmation prompt, backup behavior, or explicit overwrite option is implemented. This can cause unintended data loss when users reuse an output directory. The output path remains inside the user-selected output directory, and the extension is constrained to JPEG or PNG. Therefore, the confirmed issue is silent replacement of matching files rather than unrestricted path traversal. ### Attack Path 1. An output directory already contains a file whose name matches the deterministic naming convention, such as `meeting_00h00m00s_0001.jpg`. 2. The user runs the skill against a video with the same stem and selects that output directory. 3. The first captured frame produces the same destination path. 4. `Path.write_bytes()` truncates and replaces t ...[truncated 550 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The output naming section specifies filenames in Chinese (视频文件原始名称_视频时间轴_第几次截取.jpg) even though the rest of the skill documentation is in English and no user opt-in or locale selection is offered. This is a natural-language locale policy concern because it forces a specific language convention on generated artifacts without documenting a regional requirement.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is specified with a minimum version only, which allows future installs to resolve to different versions over time. This weakens reproducibility and makes it harder to ensure that only reviewed, non-vulnerable releases of OpenCV are installed, especially since this package processes untrusted media and has a history of memory-safety issues.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
opencv-python-headless>=4.5.0 numpy>=1.21.0

Unverifiable Dependency: opencv-python-headless has 16 known advisory(ies) (CVE-2019-14493 (NULL Pointer Dereference in OpenCV.); CVE-2019-9423 (Out-of-bounds Write in OpenCV); CVE-2019-14491 (Out-of-bounds Read in OpenCV) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: The manifest does not pin the OpenCV package, so it is impossible to verify whether the installed version avoids known CVEs affecting some releases. In this skill's context, OpenCV parses video data, which may be attacker-controlled; that makes unresolved library-version risk more significant because vulnerable image/video parsing code can lead to crashes or memory corruption.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The NumPy dependency is unpinned, so builds are not reproducible and may silently pull in newer releases with different security or stability properties. While this is a supply-chain hygiene issue rather than an immediate exploit, it increases uncertainty about what code will actually run in production.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
opencv-python-headless>=4.5.0 numpy>=1.21.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 82% confidence
Finding: Because NumPy is not pinned, the package version actually installed cannot be checked against the listed advisories with confidence. In this skill, NumPy is likely used for frame-array processing rather than direct parsing of untrusted input, so the contextual danger is lower than for OpenCV, but version ambiguity still creates avoidable security uncertainty.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.