Security audit

Mp4 To Srt

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward local video-to-subtitle converter with disclosed Traditional Chinese conversion, but users should install its dependencies carefully.

Install this only if you want subtitles converted to Traditional Chinese by default. Prefer using a virtual environment and pinned dependency versions, and avoid writing output into shared or untrusted directories.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:31
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/mp4-to-srt.sh:34
Finding: Predictable Intermediate File Permits Local File Manipulation
Content: View full analysis
/dev/null; then opencc -i "$TEMP_OUTPUT" -o "$OUTPUT" -c s2tw.json rm -f "$TEMP_OUTPUT" else mv "$TEMP_OUTPUT" "$OUTPUT" fi ``` ### Technical Analysis The intermediate filename is derived deterministically from the user-selected output path. It is created in the output directory without `mktemp`, exclusive creation, ownership validation, regular-file validation, or a private temporary directory. If the output directory is writable by another local user or untrusted process, that party can predict the intermediate path and pre-create it or replace it during execution. Depending on the behavior of `whisper`, `opencc`, and the local filesystem, this can cause subtitle corruption or make subsequent `opencc`, `rm`, or `mv` operations act on an attacker-controlled path. Symbolic-link protections implemented by individual tools or the operating system may reduce exploitability, but the script does not enforce those protections itself. ### Attack Path 1. A victim selects an output path in a shared or attacker-writable directory. 2. The attacker derives the intermediate path by replacing the output suffix with `_temp.srt`. 3. The attacker pre-creates that path or races to replace it with a crafted file or symbolic link. 4. The victim runs the conversion script. 5. `whisper` writes to the predictable path, after which `opencc`, `rm`, or `mv` processes the attacker-influenced filesystem entry. 6. The result may be corrupted output or unintended file interaction within the victim user's filesystem permissions. ### Impact Assessment The primar ...[truncated 465 chars]
Remediation: View remediation
&2 exit 1 fi opencc -i "$TEMP_OUTPUT" -o "$TEMP_DIR/final.srt" -c s2tw.json mv -- "$TEMP_DIR/final.srt" "$OUTPUT" ``` ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description and feature list state that subtitles are automatically converted to Traditional Chinese, presenting this as the default behavior rather than a user-selected option. This is a natural-language locale policy concern because the skill imposes a specific script/locale output without documenting an opt-in or alternative choice in the skill description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The description states that output is automatically converted to Traditional Chinese, which overrides user language preferences without explicit opt-in. While not a direct security exploit, this can cause unauthorized content transformation, incorrect output for multilingual workflows, and unexpected disclosure or processing choices in downstream systems that assume faithful transcription.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script description and output text state that subtitles are automatically converted to Traditional Chinese, which imposes a specific locale/language behavior by default. Although line 16 defines a CONVERT_TW parameter, the script never uses it to offer or honor user choice, so the locale preference is effectively forced.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This manifest description states what the skill does, but provides no clear trigger phrases, scope boundaries, or exclusion conditions. In manifest files, that can make invocation conditions overly broad or ambiguous, increasing the chance the skill is matched when a user generally mentions converting video or subtitles.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.