Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Security audit
Video Table Transcriber GPT
Security checks for vulnerabilities and agentic risk
Overview
This is a local video-table transcription helper with disclosed file, Python, FFmpeg, and optional OCR use, and I found no evidence of exfiltration, persistence, or deceptive behavior.
Install only if you are comfortable with a Russian-language workflow that may be implicitly selected for relevant video/table transcription tasks and that processes user-provided media locally with Python/FFmpeg and optional Tesseract. Avoid feeding sensitive industrial or account data unless you intend the agent to analyze those files, and do not authorize external OCR services unless you explicitly want that.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill explicitly instructs use of local files, Python, and shell-capable tooling, but it does not declare an explicit tool scope or permission boundary. In an agent environment, this can lead to overbroad access, making it easier for the skill to read or modify unintended local files or invoke shell commands beyond what is minimally necessary.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill enables implicit invocation for a broadly described video/table transcription capability without any visible trigger constraints, scope limits, or exclusion conditions. That increases the chance the platform will auto-route unrelated user content or sensitive screenshots/videos into this skill unexpectedly, which can cause unintended processing of confidential visual data and reduce user awareness/consent.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file contains user-facing instructions exclusively in Russian from start to finish. Under the policy, forcing a specific language without user opt-in or a clearly justified locale-specific scope is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file contains all user-facing instructions in Russian, and there is no indication that the skill is intended only for Russian-speaking users or a specific regional context. Under the policy rule for natural-language violations, forcing a specific language without user opt-in is a locale-policy issue.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python colors, grid = fixture(root) def call(*args, expected=0): result = subprocess.run([sys.executable, str(script), *map(str, args)], capture_output=True, text=True) if result.returncode != expected: raise AssertionError(f"{args}: expected {expected}, got {result.returncode}\n{result.stdout}\n{result.stderr}") return result
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python call("split", "--image", root / "synthetic.png", "--grid", root / "crossed.json", "--out", root / "rejected", expected=1) if shutil.which("tesseract"): call("ocr", "--manifest", out / "manifest.json", "--lang", "unavailable_test_language", "--out", out / "missing.json", expected=1) langs = subprocess.run(["tesseract", "--list-langs"], capture_output=True, text=True, check=True).stdout.splitlines()[1:] if "eng" in langs: call("ocr", "--manifest", out / "manifest.json", "--lang", "eng", "--out", out / "ocr.json") draft = json.loads((out / "ocr.json").read_text())
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run(args): return subprocess.run([str(x) for x in args], check=True, capture_output=True, text=True) def new_dir(path):
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The user-facing description and default prompt are written entirely in Russian, which can impose a language/locale preference without offering user choice or documenting that the skill is intended only for Russian-speaking users. This may violate language or locale policy expectations for broadly available skills.
- Content
Static analysis
No suspicious patterns detected.