视频自动笔记制作

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.2

Overview

The skill is mostly a coherent video-to-notes workflow, but it tells agents to use browser login cookies by default, which is too sensitive without explicit user opt-in.

Install only if you are comfortable with a workflow that downloads media and writes video, transcript, frame, and note files locally. Do not let it use --cookies-from-browser or logged-in browser profiles unless you explicitly approve that for a specific authorized video; prefer public URLs, manual downloads, a dedicated browser profile, or narrowly exported cookies. Use pinned, isolated dependency installs for yt-dlp where possible.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:46

Finding

Default Access to Browser Authentication Cookies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46–54; related retry guidance at line 63
Vulnerability Type: Excessive access to browser authentication material
Risk Level: Medium

Vulnerable Code

bash

# YouTube: use browser cookies by default to reduce 403 errors
yt-dlp -P "/path/to/workspace" --cookies-from-browser chrome -o "%(title)s.%(ext)s" "YOUTUBE_URL"

markdown

- YouTube / YouTube Music: use `--cookies-from-browser chrome` by default. Supported browser cookie sources include `chrome`, `firefox`, `safari`, `edge`, `brave`, and `opera`.

Related retry guidance:

markdown

- `HTTP 403 Forbidden`: retry with `--cookies-from-browser chrome` or another browser where the user is logged in.

Technical Analysis

The workflow instructs the Agent to import cookies from a logged-in browser by default when downloading YouTube content. Browser cookie stores contain sensitive session authentication material. Accessing them is generally unnecessary for public videos and violates the principle of least privilege unless the requested resource explicitly requires authentication.

Although cookie domain restrictions normally limit where individual cookies are transmitted, the selected yt-dlp process receives access to the browser cookie database and may use authenticated sessions while processing the supplied URL. The risk increases if the installed downloader or one of its extractors is compromised, the URL resolves through an unexpected extraction flow, or the browser profile has access to private or account-scoped media.

Cookie access is presented as a default rather than an explicit, informed, user-approved escalation.

Attack Path

1. A user or attacker supplies a video URL for processing.
2. The Agent follows the documented YouTube workflow.
3. The Agent invokes yt-dlp with --cookies-from-browser chrome.
4. yt-dlp reads authentication cookies from the logged-in Chrome profile.
5. The download runs with ...[truncated 972 chars]

Remediation

View remediation

Remediation Suggestions

1. Attempt every download without browser cookies first.
2. Request explicit user consent before reading any browser cookie store.
3. Explain why authentication is needed and which browser profile will be accessed.
4. Restrict authenticated downloads to an allowlist of expected domains.
5. Use a dedicated, minimally privileged browser profile rather than the user's primary profile.
6. Do not automatically retry authentication failures with another logged-in browser.
7. Prefer narrowly scoped exported cookies where supported, protect the cookie file with restrictive permissions, and securely delete it after use.
8. Add guidance that private or restricted content must only be accessed when the user is authorized to download it.

A safer command should be the default:

bash

yt-dlp -P "/path/to/workspace" -o "%(title)s.%(ext)s" "YOUTUBE_URL"

Cookie-enabled execution should occur only after anonymous access fails and the user expressly approves the escalation.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party Downloader Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35 and 68
Vulnerability Type: Unpinned dependency installation from a mutable package source
Risk Level: Medium

Vulnerable Code

bash

which yt-dlp || echo "yt-dlp not installed. Install with: pip install yt-dlp"

Related installation guidance:

markdown

- `yt-dlp: command not found`: install `yt-dlp` or ask the user to install it.

Technical Analysis

The documentation recommends installing yt-dlp without specifying a reviewed version, cryptographic hashes, an isolated environment, or a trusted package index. Consequently, the installed artifact can change over time even though the audited Skill files remain unchanged.

Package installation and subsequent execution introduce third-party code into the workflow. That code processes attacker-influenced URLs and may also receive access to browser cookie stores under the authenticated download instructions. A compromised package release, package-index compromise, dependency compromise, or unexpected future version could therefore execute with the privileges of the user running the Agent.

The package name shown is not a typosquat, and the audited project does not automatically execute pip install. The risk arises from unsafe installation guidance that permits mutable, unverified dependency resolution.

Attack Path

1. The Agent or operator determines that yt-dlp is unavailable.
2. The documented pip install yt-dlp guidance is followed.
3. pip resolves the latest available package and transitive dependencies from its configured index without hash verification.
4. A compromised or unexpectedly changed package is installed.
5. The workflow executes the installed downloader against a user-provided URL.
6. The dependency executes with the Agent user's filesystem, network, and process privileges.
7. If browser-cookie mode is also used, the compromised dependency may gain access to sensitive authentication material.

...[truncated 767 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin yt-dlp to a specifically reviewed version.
2. Verify downloaded distributions with approved cryptographic hashes.
3. Install the package in a dedicated virtual environment rather than the global Python environment.
4. Use an explicitly configured and trusted package index.
5. Record and review all transitive dependencies where applicable.
6. Establish a controlled update process that tests and reviews new versions before changing the pin.
7. Avoid automatically installing packages during Skill execution; require operator approval.
8. Run the downloader with reduced filesystem and network privileges where the environment supports sandboxing.
9. Keep browser-cookie access disabled unless separately authorized.

For reproducible installation, use a reviewed requirements or lock file with hashes, for example:

text

yt-dlp==REVIEWED_VERSION --hash=sha256:REVIEWED_DISTRIBUTION_HASH

Then install it into an isolated environment with hash enforcement:

bash

python3 -m venv .venv
.venv/bin/python -m pip install --require-hashes -r requirements.txt

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises an end-to-end video learning note pipeline: download from URL, transcribe audio, combine subtitles with screenshot analysis, and produce a complete Markdown note. The supplied code only covers a narrower asset-preparation step. It requires a local video path, checks for ffmpeg/ffprobe, extracts frames based on interval/scene detection, writes a manifest, and emits a Markdown skeleton with placeholders. There is no URL handling, no downloading, no STT/transcription, no subtitle ingestion, no screenshot understanding, and no final note generation beyond a template. This is a material description-behavior mismatch in primary purpose and capabilities.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 99% confidence

Finding

Using --cookies-from-browser instructs the agent to extract authenticated browser session data from local browsers. That behavior overlaps with credential-harvesting patterns because cookies can grant account access or act as bearer tokens, especially when the skill says to use them by default across multiple browsers.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

-dlp || echo "yt-dlp not installed. Install with: pip install yt-dlp" which ffmpeg || echo "ffmpeg not installed. Install with: brew install ffmpeg"

text

Recommended commands:

```bash
# Generic: download best quality into the workspace
yt-dlp -P "/path/to/workspace" -o "%(title)s.%(ext)s" "VIDEO_URL"

# YouTube: use browser cookies by default to reduce 403 errors
yt-dlp -P "/path/to/workspace" --cookies-from-browser chrome -o "%(title)s.%(ext)s" "YOUTUBE_URL"

# Download subtitles when available; still run qwen-audio/STT unless the user only wants official subtitles
yt-dlp -P "/path/to/workspace" --write-subs --sub-langs all -o "%(title)s.%(ext)s" "VIDEO_URL"

Platform handling principles:

• YouTube / YouTube Music: use --cookies-from-browser chrome by default. Supported browser cookie sources include chrome, firefox, safari, edge, brave, and opera.
• Bilibili, Twitter/X, TikTok, Douyin, Vimeo, Twitch, and most other platforms: try direct download first.
• Playlist

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

For each candidate image:

1. Read the image file content with vision; do not judge only from the filename or timestamp.
2. Locate the subtitles around the same timestamp in `transcript.srt`, usually the preceding and following 15–30 seconds.
3. Decide whether the image provides learning value beyond the transcript.
4. Keep the frame as a key screenshot only when it helps explain, supplement, or preserve important information.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill directs use of shell commands and file writes but declares no explicit tool scope or permission boundaries. That increases the chance an agent can perform downloading, filesystem modification, and external command execution without clear least-privilege constraints or user-visible guardrails.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill recommends using browser cookies for downloads, which accesses local authenticated session material unrelated to normal note generation. This expands the skill from content processing into credential-adjacent data access, creating privacy and account misuse risk if an agent reads or forwards cookies without strong consent controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Recommending browser-cookie access without an explicit privacy warning is dangerous because it may expose active login sessions, account metadata, and sensitive browsing state. Users may not realize the skill is instructing an agent to access local authentication material rather than just public video content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The writing standard says 'Write in Chinese unless the user asks otherwise,' which imposes a specific language preference by default. This is a natural-language policy issue because it selects a locale without explicit user opt-in.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/prepare_video_learning_assets.py (reported line 16)May include surrounding context.

python

def run(cmd: list[str]) -> str:
    result = subprocess.run(cmd, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    return result.stdout.strip()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/prepare_video_learning_assets.py (reported line 67)May include surrounding context.

python

"null",
        "-",
    ]
    result = subprocess.run(cmd, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
    text = result.stdout + "\n" + result.stderr
    times: list[float] = []
    for match in re.finditer(r"pts_time:([0-9]+(?:\.[0-9]+)?)", text):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/prepare_video_learning_assets.py (reported line 91)May include surrounding context.

python

def extract_frame(video: Path, out_file: Path, seconds: float) -> None:
    subprocess.run(
        [
            "ffmpeg",
            "-y",

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The generated skeleton content is hard-coded entirely in Chinese, including headings and instructional text. Because the script provides no language selection or opt-in and the file path/purpose is not clearly region-specific, this creates a natural-language locale policy issue under the requirement not to force a specific language without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs downloading videos and creating multiple artifacts on disk without warning about storage usage or filesystem changes. While not directly exploitable like credential theft, it can lead to unexpected disk consumption, overwritten files, or privacy issues from storing media and transcripts locally.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

Troubleshooting:

- `HTTP 403 Forbidden`: retry with `--cookies-from-browser chrome` or another browser where the user is logged in.
- `Video unavailable`, private videos, or geo-restricted videos: ask the user for login access, cookies, or an accessible environment; do not bypass access restrictions.
- `Format not available`: run `yt-dlp -F "VIDEO_URL"` to list available formats, then choose one.
- Interrupted downloads: retry; yt-dlp can usually resume partial downloads.
- `yt-dlp: command not found`: install `yt-dlp` or ask the user to install it.

Static analysis

No suspicious patterns detected.