video2txt-视频理解字幕提取

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 10:07 PM UTC
• Version: 1.0.1

Overview

This is a coherent local media transcription skill with disclosed file outputs and model downloads, though users should note the unpinned Python dependencies and automatic model download.

Install this only in an environment where you are comfortable allowing pip to fetch current package versions and allowing the first run to download Whisper model files. Run it on media files you intentionally select, and review output paths because it writes SRT/TXT files and creates a model cache directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies Permit Unreviewed Package Installation

Content

View full analysis

=1.1.0 av>=12.0.0 opencc-python-reimplemented>=0.1.7 ``` `_meta.json:8-10`: ```json "faster-whisper": ">=1.1.0", "av": ">=12.0.0", "opencc-python-reimplemented": ">=0.1.7" ``` `SKILL.md:81` instructs users to install these dependencies: ```bash python -m pip install -r requirements.txt ``` ### Technical Analysis Every dependency uses an open-ended minimum-version constraint. No lockfile, exact version constraint, package hash, or restricted package source is provided. Consequently, the installation command can resolve to dependency versions that were never reviewed with this project. Python package installation may execute package build or installation logic, while imported dependencies execute code with the privileges of the user running the skill. If a permitted upstream package release or configured package index is compromised, the effective code installed and executed by this project can change without any modification to the audited repository. This is a supply-chain weakness rather than evidence that the currently named packages are malicious. ### Attack Path 1. An attacker compromises an upstream dependency release, its publishing account, or a package index used by the victim. 2. The attacker publishes a newer package version satisfying one of the open-ended `>=` constraints. 3. A user follows the installation command in `SKILL.md`. 4. Pip resolves and downloads the attacker-controlled release because no exact version or trusted hash is required. 5. Malicious package installation logic or imported runtime code executes with the permissions of the user running pip or the transcription script. ### Impact Assessment Successful exploitation could execute arbitrary code under the ...[truncated 426 chars]

Remediation

View remediation

other

Note

• Location: SKILL.md:22

Finding

Invisible Zero-Width Character in Agent-Consumed Skill Instructions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (12)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: video2txt
description: 将本地视频或音频文件转写为 SRT 字幕文件和 TXT 纯文本文件
metadata: { "openclaw": { "emoji": "video", "requires": { "bins": ["python3"] } } }
---

# video2txt 技能

## 描述

将本地视频或音频文件转写为 SRT 字幕文件和 TXT 纯文本文件。

## 功能

- 提取视频/音频中的语音内容
- 生成带时间戳的 SRT 字幕文件
- 生成纯文本 TXT 文件
- 支持多种视频和音频格式
- 默认使用中文识别，自动转换为简体中文

​	使用场景：

1. 需要读取视频内容或理解视频时

## 使用方法

###

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

- 支持多种视频和音频格式
- 默认使用中文识别，自动转换为简体中文

​	使用场景：

1. 需要读取视频内容或理解视频时

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises shell execution and file-writing behavior through its documented usage, but the manifest does not declare any explicit tool scope such as allowed tools or permissions. This weakens policy enforcement and reviewability, making it easier for an agent to invoke shell/file operations without clear least-privilege boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description states the skill '默认使用中文识别，自动转换为简体中文', which imposes a language/locale behavior by default rather than offering a user choice. This is a natural-language policy concern because it forces a specific language/script preference unless the user notices and overrides it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description is written as an instruction that the skill converts local video or audio files into SRT and TXT outputs in Chinese, with no indication that language selection is optional. Under the policy rule, a skill that imposes a specific language or locale without user opt-in should be flagged unless the constraint is clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script sets DEFAULT_LANGUAGE = "zh", making Chinese the default recognition language unless the user explicitly changes it. This is a natural-language locale policy concern because it imposes a specific language preference by default rather than starting from neutral auto-detection or explicit user choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_to_text.py (reported line 109)May include surrounding context.

python

str(file_path),
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0 and result.stdout.strip():
            return float(result.stdout.strip())
    except Exception:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is described as operating on local media files, but load_whisper_model passes model_size and download_root to faster-whisper, which may trigger network downloads of model artifacts if they are not already present locally. In restricted or privacy-sensitive environments, this can violate user expectations, create unapproved outbound network access, and introduce supply-chain exposure to externally fetched model files.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is only lower-bounded and not pinned to an exact version, so installs may resolve to different upstream releases over time. This increases supply-chain risk because a later compromised, buggy, or breaking release could be pulled into the skill without review, reducing build reproducibility and security assurance.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

faster-whisper>=1.1.0
av>=12.0.0
opencc-python-reimplemented>=0.1.7

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using av>=12.0.0 permits any newer release to be installed, which can introduce unreviewed code changes or vulnerable versions into the environment. For packages handling media parsing, unexpected upstream changes can be especially risky because they process complex file formats and often depend on native components.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

faster-whisper>=1.1.0
av>=12.0.0
opencc-python-reimplemented>=0.1.7

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

opencc-python-reimplemented>=0.1.7 is unpinned, so future installations may silently consume a different release than the one originally tested. This creates a supply-chain and reproducibility weakness, as a malicious or vulnerable upstream release could be introduced without code changes in the skill itself.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

faster-whisper>=1.1.0
av>=12.0.0
opencc-python-reimplemented>=0.1.7

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The skill's stated purpose is transcription of local media into subtitle/text files, but get_media_duration executes ffprobe through subprocess.run. While media inspection can support progress reporting, spawning external binaries is a broader execution capability than the manifest describes and is not necessary for generating the transcript outputs themselves.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.