学习类视频转笔记工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:42 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches a video-to-notes tool, but it includes unrelated scripts that execute or overwrite files in a hard-coded external workspace and its note organizer can fabricate transcript-derived notes.

Review this before installing. The core video transcription workflow is recognizable, but remove or ignore the monitor scripts and hard-coded personal start script unless you fully trust that external workspace. Expect the tool to write tmp and done directories near your videos, retain intermediate transcripts/audio despite one doc claim about cleanup, and send local path metadata by email when the workflow completes.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T07 · Tool Hijacking and Spoofing

Error

• Location: start_monitor.sh:1

Finding

Execution of an Unbundled Mutable Monitor Script and Broad Process Termination

Content

View full analysis

/dev/null sleep 1 cd /home/fangjinan/.openclaw/workspace/skills/video-note-maker python3 monitor_web.py ``` ### Technical Analysis The launcher executes `monitor_web.py` from a hard-coded external workspace instead of resolving and executing a script bundled with the audited project. The referenced file is absent from the reviewed package, so its contents, provenance, and integrity cannot be established during the Skill audit. An actor who can modify the external `monitor_web.py` file can replace it with arbitrary Python code. The substituted code will execute with the privileges of the user who invokes `start_monitor.sh`. The command `pkill -f monitor_web.py` is also overly broad. The `-f` option matches against complete process command lines, so it may terminate unrelated processes merely because their command line contains `monitor_web.py`. The script does not verify process ownership, executable identity, or a Skill-specific PID before termination. ### Attack Path 1. An attacker obtains write access to `/home/fangjinan/.openclaw/workspace/skills/video-note-maker/monitor_web.py`, such as through another vulnerable local component, shared workspace permissions, or a compromised update process. 2. The attacker replaces or modifies `monitor_web.py` with an arbitrary Python payload. 3. The user invokes `start_monitor.sh`, believing it starts the legitimate monitoring component. 4. The launcher changes to the external directory and executes the attacker-modified file with the invoking user's privileges. 5. Before execution, `pkill -f monitor_web.py` may also terminate legitimate or unrelated processes whose command lines match that string. A denial-of-ser ...[truncated 774 chars]

Remediation

View remediation

/exe` and its command line correspond to the expected bundled monitor. 6. Run the monitor with the minimum required filesystem and network permissions. 7. Fail closed when the expected bundled script or its integrity metadata is missing. ]]>

T07 · Tool Hijacking and Spoofing

Warning

• Location: fix_monitor.py:1

Finding

Undocumented Overwrite of an External Workspace Tool

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:35

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (36)

Tainted flow: 'CONFIG' from os.environ.get (line 18, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 95% confidence

Finding

The skill transmits processing status to an arbitrary Feishu webhook taken from the environment, without meaningful user disclosure or consent. In this script's context, those messages include video filenames, progress, note paths, and completion details, which can leak potentially sensitive local metadata to an external service.

Content

Scanner excerpt · video_note_maker.py (reported line 377)May include surrounding context.

python

}
        }
        headers = {"Content-Type": "application/json"}
        response = requests.post(CONFIG["feishu_webhook"], json=data, headers=headers, timeout=10)
        if response.status_code == 200:
            return True
        else:

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The tool claims to organize notes from transcripts but actually discards the transcription content and emits a hard-coded OSPF/ABR template. This is dangerous because it silently fabricates output while presenting it as transcript-derived, creating integrity failures, misinformation, and potential downstream misuse in educational or business contexts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The generated Markdown explicitly states that the content is based on the video's transcript and preserves the teaching order, but the inserted body is static and unrelated to input. This compounds the integrity problem by adding deceptive provenance claims that may cause users to trust false notes and redistribute them as accurate summaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README documents that processing creates a tmp directory beside the source videos and later cleans temporary files, but it does not clearly warn users that the tool writes and deletes files inside the source directory tree. This can lead to accidental data loss, confusion during execution, or unsafe use on directories where users do not expect destructive behavior.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 43)May include surrounding context.

bash

# Ubuntu/Debian
sudo apt-get install ffmpeg

# Python 依赖
pip3 install openai-whisper

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 149)May include surrounding context.

bash

# Ubuntu/Debian
sudo apt-get install ffmpeg

# Python 依赖
pip3 install openai-whisper

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The configuration example sets "language": "zh", which indicates a fixed language default. The document does not explain that users may choose another language or that this skill is intentionally limited to Chinese-only use, creating a locale-policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation states the transcription language is fixed to Chinese ('zh') rather than offering a language choice. Under SQP-3, a forced language/locale is a policy issue unless the skill offers opt-in or clearly justifies the restriction as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow automatically emails completion details and includes sensitive metadata such as full video paths, output paths, timestamps, and potentially note-related content without a prominent privacy warning or explicit opt-in at the point of use. This can cause unintended disclosure of personal, corporate, or filesystem information to external services and recipients, especially because SMTP/IMAP use and recipient configuration are embedded into the workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The --auto mode bypasses user confirmation and, according to the documented workflow, immediately performs file creation, transcript generation, note organization, and external notification. Without an explicit warning, users may trigger irreversible or privacy-impacting actions unintentionally, including sending metadata off-host and modifying local directories.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The config example sets "language": "zh", which indicates a fixed locale choice embedded in the skill behavior. Because no user choice or opt-in is described nearby, this is a natural-language policy concern under SQP-3.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The note at L293 claims the tool will automatically clean the tmp directory after processing. However, the documented outputs and email content explicitly reference retained files under tmp/{视频名}/, including audio segments and transcript_*.txt files, with no documented cleanup step in the workflow. This is an active contradiction about whether intermediate artifacts persist.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The config hard-codes the language to "zh", which indicates the skill is restricted to Chinese without any visible option for the user to select another language. This is a natural-language policy concern because the file does not document an opt-in, fallback, or justified region-specific constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script directly overwrites another skill file on disk using a hard-coded path and provides no user confirmation, backup, integrity check, or authorization control. This is dangerous because a user or agent running the script may unintentionally modify production skill code, and the same pattern could be repurposed to tamper with trusted files or silently introduce unwanted behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script forcefully terminates any process whose command line matches 'monitor_web.py' without confirmation, scoping, or validation that it is the intended process instance. This can disrupt unrelated processes with the same name pattern and creates an unnecessary availability risk, especially in shared or multi-project environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The configuration forces Whisper transcription to use zh, which imposes a specific language/locale behavior on all runs. There is no CLI option or documented opt-in allowing users to choose another language, so this conflicts with the policy against forcing a locale without user choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · video_note_maker.py (reported line 268)May include surrounding context.

python

qqmail_user = os.environ.get("QQMAIL_USER", "[e-mail]")
    
    try:
        result = subprocess.run([
            "python3", qqmail_script, "send",
            "--to", qqmail_user,
            "--subject", email_subject,

Tainted flow: 'qqmail_user' from os.environ.get (line 265, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · video_note_maker.py (reported line 268)May include surrounding context.

python

qqmail_user = os.environ.get("QQMAIL_USER", "[e-mail]")
    
    try:
        result = subprocess.run([
            "python3", qqmail_script, "send",
            "--to", qqmail_user,
            "--subject", email_subject,

Tainted flow: 'output_path' from os.environ.get (line 550, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · video_note_maker.py (reported line 321)May include surrounding context.

python

# 保存文件
    os.makedirs(done_dir, exist_ok=True)
    output_path = os.path.join(done_dir, f"{base_name}_学习笔记_整理版.md")
    with open(output_path, 'w', encoding='utf-8') as f:
        f.write(md_content)
    
    print(f"\n✅ 整理版笔记已保存：{output_path}")

Tainted flow: 'output_path' from os.environ.get (line 550, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · video_note_maker.py (reported line 552)May include surrounding context.

python

# 保存文件
    os.makedirs(done_dir, exist_ok=True)
    output_path = os.path.join(done_dir, f"{base_name}_学习笔记_整理版.md")
    with open(output_path, 'w', encoding='utf-8') as f:
        f.write(md_content)
    
    print(f"\n✅ 整理版笔记已保存：{output_path}")

Tainted flow: 'output_path' from os.environ.get (line 550, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · video_note_maker.py (reported line 615)May include surrounding context.

python

# 保存文件
    os.makedirs(done_dir, exist_ok=True)
    output_path = os.path.join(done_dir, f"{base_name}_学习笔记_整理版.md")
    with open(output_path, 'w', encoding='utf-8') as f:
        f.write(md_content)
    
    print(f"\n✅ 整理版笔记已保存：{output_path}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script automatically emails video metadata and local output paths after processing, without an explicit pre-send consent step. In this context, filenames and filesystem paths may reveal sensitive project names, personal data, or directory structures to external services or recipients.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This code performs external transmission to a Feishu webhook, sending status text that includes metadata about user files and processing activity. In a local media-processing skill, undisclosed network egress is more dangerous because users may expect transcription and note generation to remain local.

Content

Scanner excerpt · video_note_maker.py (reported line 377)May include surrounding context.

python

}
        }
        headers = {"Content-Type": "application/json"}
        response = requests.post(CONFIG["feishu_webhook"], json=data, headers=headers, timeout=10)
        if response.status_code == 200:
            return True
        else:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · video_note_maker.py (reported line 420)May include surrounding context.

python

'-b:a', CONFIG['audio_quality']['bitrate'],
            output_path
        ]
        subprocess.run(cmd, check=True)
        print(f"✅ 音频已提取：{output_path}")
        print(f"💡 使用 AAC 编码，文件大小约为 PCM_WAV 的 1/10")
        return output_path

Tainted flow: 'cmd' from os.environ.get (line 412, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · video_note_maker.py (reported line 420)May include surrounding context.

python

'-b:a', CONFIG['audio_quality']['bitrate'],
            output_path
        ]
        subprocess.run(cmd, check=True)
        print(f"✅ 音频已提取：{output_path}")
        print(f"💡 使用 AAC 编码，文件大小约为 PCM_WAV 的 1/10")
        return output_path