aaaa

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:33 AM UTC
• Version: 1.0.1

Overview

This skill has some rough scoping and execution choices, but its file writes, Markdown processing, and screenshot generation are disclosed and fit the subtitle-to-notes workflow.

Install only if you are comfortable with the skill creating Markdown/output files and running a bundled Python script that may invoke ffmpeg on a local MP4 in the current directory. Use it in a clean folder containing only the intended generated Markdown and video file to avoid processing the wrong file.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared purpose is converting SRT subtitles to Markdown notes, but the behavior described by analysis includes scanning local files, invoking screenshot extraction, generating attachments, and modifying Markdown. This description-behavior mismatch is dangerous because it can conceal broader filesystem access and subprocess execution behind an innocuous-looking skill description, reducing user and reviewer scrutiny.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The implementation materially diverges from the declared skill purpose: instead of converting SRT to Markdown, it scans existing Markdown and optionally processes local MP4 files with ffmpeg. This kind of capability mismatch is dangerous because users and reviewers may authorize the skill under false assumptions, allowing unintended file processing and external tool execution in their workspace.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill text instructs writing files to the project root and executing a Python script, which implies file and shell capabilities, yet it declares no explicit tool scope or permissions. This creates an unsafe mismatch where an agent may perform filesystem changes and code execution without transparent authorization boundaries, increasing the risk of unintended or abusive actions.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The instruction `使用中文书写` forces a specific language choice in the skill behavior. The file does not provide user opt-in, alternatives, or a documented reason that would justify a Chinese-only constraint.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill mandates saving output to the project root, which modifies user files without warning or consent. Unannounced writes can overwrite existing content, create persistence in a repository, or alter a workspace in ways the user did not expect.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs running a local Python script without any warning that code will be executed. Silent subprocess execution is risky because the script may perform arbitrary actions on the host, access local data, invoke external binaries such as ffmpeg, or make further modifications beyond the stated task.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This file contains natural-language comments, docstrings, log messages, and errors in Chinese only, such as the screenshot-related documentation and runtime messages. That creates a language/locale restriction for operators or users without offering a choice or documenting a justified region-specific constraint, which fits the policy-violation category.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The script introduces ffmpeg-based video processing that is not justified by the stated SRT-to-Markdown purpose, expanding the attack surface through external binary execution and parsing of potentially untrusted media files. Even without shell injection, invoking complex media tooling on arbitrary local inputs can expose the environment to parser bugs, unexpected resource consumption, or unauthorized processing of unrelated files.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-y",
    ]
    logging.info("生成截图：time=%s, file=%s", timestamp, output_path)
    subprocess.run(cmd, check=False, capture_output=True)
    return output_path

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The code and messaging claim SRT handling, but the logic actually searches for .md files and rewrites Screenshot markers, which is a deceptive behavior mismatch. In agent skill ecosystems, this is security-relevant because hidden or mislabeled file-processing behavior can cause unintended modification of user content and undermine informed consent.

Static analysis

No suspicious patterns detected.