video-knowledge-ingest

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:42 AM UTC
• Version: 1.0.0

Overview

The skill performs the disclosed video ingestion, transcription, summarization, and local storage workflow without evidence of hidden or deceptive behavior.

Install only if you are comfortable with the skill downloading media, running local transcription tools, sending transcripts to the configured Codex-backed summarizer, and retaining transcript/summary/metadata files in a local knowledge base. Avoid private, regulated, or confidential inputs unless that processing and retention are acceptable, and choose a custom --kb-root or manually clean up outputs when needed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/video_ingest.py:258

Finding

Local File Contents May Be Disclosed to the Configured Codex Backend

Content

View full analysis

tuple[Path, str, dict[str, Any]]: meta = { 'title': path.stem, 'source_path': str(path), 'platform': 'local', 'id': hashlib.sha1(str(path).encode('utf-8')).hexdigest()[:12], } json_dump(item_dir / 'source.info.json', meta) suffix = path.suffix.lower() if suffix in SUB_EXTS: transcript_path = item_dir / 'transcript.txt' transcript_path.write_text(strip_subtitle_to_text(path), encoding='utf-8') return transcript_path, f'subtitles:{path.name}', meta if suffix in TEXT_EXTS: transcript_path = item_dir / 'transcript.txt' shutil.copy2(path, transcript_path) return transcript_path, f'text:{path.name}', meta if suffix in MEDIA_EXTS: transcript_path, backend = transcribe_media(path, item_dir, language) return transcript_path, backend, meta ``` ```python def summarize_transcript(transcript_path: Path, length: str) -> str: proc = run([ SUMMARIZE, str(transcript_path), '--plain', '--cli', 'codex', '--force-summary', '--length', length, '--timeout', '5m', ], capture=True) return proc.stdout.strip() + '\n' ``` ```python transcript_text = read_text(transcript_path) if not transcript_text.strip(): raise RuntimeError('transcript is empty') summary_text = summarize_transcript(transcript_path, args.length) ``` ### Technical Analysis The Skill accepts arbitrary local text, Markdown, subtitle, audio, and video files. Text files are copied directly into `transcript.txt`, while subtitle and media files are converted or tran ...[truncated 2009 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/video_ingest.py:181

Finding

Untrusted Subtitle and Transcript Content Reaches an LLM Without Prompt-Injection Controls

Content

View full analysis

str: proc = run([ SUMMARIZE, str(transcript_path), '--plain', '--cli', 'codex', '--force-summary', '--length', length, '--timeout', '5m', ], capture=True) return proc.stdout.strip() + '\n' ``` ```python subtitle_candidates = sorted([p for p in download_dir.glob('source*.srt')] + [p for p in download_dir.glob('source*.vtt')]) chosen_sub = choose_best_subtitle(subtitle_candidates) if chosen_sub and chosen_sub.stat().st_size > 0: transcript_text = strip_subtitle_to_text(chosen_sub) transcript_path = item_dir / 'transcript.txt' transcript_path.write_text(transcript_text, encoding='utf-8') return transcript_path, f'subtitles:{chosen_sub.name}', raw_meta ``` The generated result is subsequently persisted without security validation: ```python summary_text = summarize_transcript(transcript_path, args.length) summary_path = item_dir / 'summary.md' summary_path.write_text( build_summary_markdown(title, source, str(platform), transcript_source, summary_text, 'transcript.txt'), encoding='utf-8', ) ``` ### Technical Analysis Remote subtitles and transcribed speech are attacker-controlled data. The Skill forwards this data directly to an LLM-backed summarizer without adding a trusted instruction layer that explicitly identifies the transcript as untrusted source material. There are no delimiters separating trusted summarization instructions from transcript content, no instruction to ignore commands embedded in the source, no structured output constraint, and no validation of the resulting summary. Subtitle cleanup removes timestamps and markup but does ...[truncated 1993 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description describes an end-to-end cross-platform video ingestion and summarization workflow, including remote fetching, subtitle retrieval, fallback downloading/transcription, summarization, metadata persistence, and debugging of platform-specific failures. The supplied code chunk only implements one narrow sub-step: local media transcription using ffmpeg and faster-whisper, with export to several transcript formats. While ffmpeg/Whisper transcription is consistent with part of the declared workflow, the primary declared purpose is much broader and materially different from the actual behavior of this script.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/video_ingest.py (reported line 70)May include surrounding context.

python

def run(cmd: list[str], *, cwd: Path | None = None, capture: bool = False, check: bool = True) -> subprocess.CompletedProcess[str]:
    env = os.environ.copy()
    env['PATH'] = f"/home/jason/.local/bin:/home/jason/.npm-global/bin:{env.get('PATH','')}"
    proc = subprocess.run(
        cmd,

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs use of shell commands, network access, environment-dependent tooling, and persistent filesystem writes, but it does not declare any explicit tool scope or allowed-tools/permissions boundary. That makes the effective privilege surface implicit and harder to review or constrain, increasing the risk of unintended command execution, remote fetching, and local data modification when the skill is invoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly directs persistent storage of transcripts, summaries, metadata, and a global append-only index in a local knowledge base, but it does not provide a clear upfront warning about retention, sensitivity, or cleanup expectations. Because ingested videos may contain personal, copyrighted, or confidential information, silent persistence can create privacy, compliance, and data exposure risks beyond the user's immediate intent.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_ingest.py (reported line 72)May include surrounding context.

python

def run(cmd: list[str], *, cwd: Path | None = None, capture: bool = False, check: bool = True) -> subprocess.CompletedProcess[str]:
    env = os.environ.copy()
    env['PATH'] = f"/home/jason/.local/bin:/home/jason/.npm-global/bin:{env.get('PATH','')}"
    proc = subprocess.run(
        cmd,
        cwd=str(cwd) if cwd else None,
        env=env,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI sets --language to zh by default, which imposes a specific language/locale behavior unless the user overrides it manually. The policy forbids forcing a language without explicit opt-in, and this default is not documented as region-specific or justified in the file.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/whisper_gpu_transcribe.py (reported line 81)May include surrounding context.

python

"-loglevel",
        "error",
    ]
    subprocess.run(cmd, check=True)


def parse_args() -> argparse.Namespace:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The documentation describes a workflow that downloads remote content, invokes external binaries, performs transcription, and writes multiple artifacts to local storage, but it does not clearly warn about network access, code/tool execution, or filesystem side effects. In an agent-skill context, missing disclosure can lead operators or downstream agents to run the workflow without understanding that it may fetch untrusted media, consume local resources, and persist potentially sensitive content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.