Video Editor

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:20 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward FFmpeg video-editing helper with some input-validation weaknesses users should be aware of before processing untrusted filenames or parameters.

Install only if you are comfortable running local FFmpeg commands on files you select. Prefer trusted media, subtitle files, filenames, dimensions, and speed values; avoid attacker-supplied filenames or parameters, and choose output paths carefully so generated media does not replace files you care about.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/add-subtitles.sh:41

Finding

FFmpeg Filtergraph Injection Through Unvalidated User-Controlled Parameters

Content

View full analysis

= 0.5 && $RATE <= 2.0" | bc -l) )); then ffmpeg -i "$INPUT" -filter_complex "[0:v]setpts=PTS/$RATE[v];[0:a]atempo=$RATE[a]" -map "[v]" -map "[a]" "$OUTPUT" else echo "Warning: Speed rate outside 0.5-2.0 range may require multiple filter passes" ffmpeg -i "$INPUT" -filter_complex "[0:v]setpts=PTS/$RATE[v]" -map "[v]" -an "$OUTPUT" fi ``` ### Technical Analysis The scripts interpolate user-controlled subtitle paths, crop coordinates, dimensions, scale values, and speed rates directly into FFmpeg filter expressions. Shell quoting prevents these values from being split into separate shell arguments, so this is not ordinary shell-command injection. However, shell quoting does not escape FFmpeg's independent filtergraph grammar. Characters meaningful to FFmpeg—including quotes, commas, semicolons, brackets, colons, and backslashes—can change how the resulting filter expression is parsed. The numeric options are only checked for being non ...[truncated 1829 chars]

Remediation

View remediation

&2 exit 1 fi ``` 3. Validate speed as a positive decimal and enforce the range supported by the selected audio-filter construction: ```bash if [[ ! "$RATE" =~ ^([0-9]+([.][0-9]+)?|[.][0-9]+)$ ]]; then echo "Error: invalid speed rate" >&2 exit 1 fi ``` 4. Escape subtitle paths according to FFmpeg filter-expression rules. Account for backslashes, colons, apostrophes, commas, and other filtergraph metacharacters. Do not assume shell quoting provides FFmpeg escaping. 5. Prefer generating a controlled filter script or using an implementation that separates validated parameter values from filtergraph structure. 6. Where operationally possible, explicitly restrict the protocols FFmpeg may use and run media processing in a sandbox with: - Minimal filesystem access. - No unnecessary network access. - CPU, memory, file-size, and execution-time limits. - A dedicated low-privilege account. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/merge.sh:33

Finding

FFconcat Directive Injection Through Unescaped Video Filenames

Content

View full analysis

> "$TEMP_LIST" done # Merge videos ffmpeg -f concat -safe 0 -i "$TEMP_LIST" -c copy "$OUTPUT" ``` ### Technical Analysis The script constructs an ffconcat manifest by embedding canonicalized user-supplied paths into records of this form: ```text file '/absolute/path/to/video' ``` The value returned by `realpath` is inserted without ffconcat-specific escaping. Unix filenames may contain apostrophes, backslashes, carriage returns, and embedded newline characters. A malicious existing filename containing these characters can terminate or alter the current `file` record and inject additional ffconcat syntax. Calling `realpath` does not sanitize these characters. Command substitution can preserve embedded newlines, even though trailing newline characters are removed. The resulting manifest can therefore contain records not intended by the script. The use of `-safe 0` weakens the concat demuxer's path safety restrictions and allows absolute or otherwise unsafe paths. This makes an injected file or protocol reference more consequential. The temporary file itself is securely created with `mktemp`. The primary vulnerability is the unsafe serialization of attacker-controlled filenames into a parser-controlled file. The double-quoted cleanup trap is also unnecessarily fragile and should be replaced with a single-quoted trap that quotes the variable at execution time. ### Attack Path 1. An attacker creates or supplies an accessible video whose filename contains ffconcat metacharacters, such as an apostrophe followed by an embedded newline and an additional directive. 2. The Agent invokes `merge.sh` with that file and a ...[truncated 1176 chars]

Remediation

View remediation

&2 exit 1 ;; esac ``` 2. Serialize paths using the exact escaping rules required by the ffconcat format. Apostrophes and backslashes must not be written through a simple `echo "file '$path'"` construction. 3. Avoid `echo` for control-file generation because implementations can treat certain values as options or interpret escapes. Use `printf` after validation and correct escaping. 4. Avoid `-safe 0` where possible. A safer design is to: - Create a private temporary directory. - Stage validated inputs there under generated filenames. - Construct a manifest containing only those controlled relative filenames. - Run the concat demuxer with its safety checks enabled. 5. Confirm that each supplied input exists, is a regular file, and resides within an approved directory before adding it to the manifest. 6. Restrict FFmpeg protocols and sandbox the process to reduce the consequences of parser or media-file attacks. 7. Harden temporary-file cleanup: ```bash TEMP_LIST=$(mktemp) || exit 1 trap 'rm -f -- "$TEMP_LIST"' EXIT ``` 8. Consider creating the manifest through a small helper written in a language with explicit byte-level validation rather than manually interpolating paths into parser syntax. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This is a markdown file, so SQP-2 applies to missing warnings in the skill description. The quick-start and workflow examples repeatedly write new output files such as output.mp4, merged.mp4, and audio.mp3, but the document does not warn users to choose output paths carefully or note that generated files may overwrite existing files depending on script behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code creates a temporary file and writes a merged video to the user-specified output path, but the only user-facing messaging is a usage line and a completion message. There is no prior disclosure that the script will create files on disk or that ffmpeg may overwrite or alter the specified output target depending on environment and invocation context.

Content

No source excerpt is available for this finding.