Security audit

学习类视频转笔记工具

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a video-to-notes tool, but it needs review because it can automatically email local file metadata and it generates some hard-coded notes unrelated to the input video.

Review before installing. Use it only on videos whose filenames and paths you are comfortable sending by email, verify generated notes against the transcript, avoid --auto until you understand the outbound email behavior, and do not run the monitor helper scripts unless their hard-coded paths and process-killing behavior are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: qqmail_user = os.environ.get("QQMAIL_USER", "your_email@example.com") try: result = subprocess.run([ "python3", qqmail_script, "send", "--to", qqmail_user, "--subject", email_subject,
Confidence: 87% confidence
Finding: result = subprocess.run([ "python3", qqmail_script, "send", "--to", qqmail_user, "--subject", email_subject, "--body", email_body ], cap

Tainted flow: 'qqmail_user' from os.environ.get (line 265, credential/environment) → subprocess.run (code execution)

Medium

Category: Data Flow
Content: qqmail_user = os.environ.get("QQMAIL_USER", "your_email@example.com") try: result = subprocess.run([ "python3", qqmail_script, "send", "--to", qqmail_user, "--subject", email_subject,
Confidence: 89% confidence
Finding: result = subprocess.run([ "python3", qqmail_script, "send", "--to", qqmail_user, "--subject", email_subject, "--body", email_body ], cap

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The documentation presents conflicting behavior for email recipients: one section says notifications go to a user-configured mailbox, while the changelog states mail is automatically sent to a specific hard-coded QQ address. In a skill that processes potentially sensitive local media and file metadata, this inconsistency is dangerous because it can mask unauthorized outbound transmission to a third party.

Intent-Code Divergence

High

Confidence: 98% confidence
Finding: The tool claims to summarize transcripts but actually ignores them and emits hard-coded OSPF study notes. In a note-making skill, this is dangerous because it can silently fabricate output, mislead users into trusting false content, and potentially conceal that the tool did not process the supplied data at all.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The Feishu sender is broken by unreachable logic, so operators may believe progress and completion notifications are being sent when they are not. In an automated workflow, misleading status reporting can cause missed monitoring, delayed response, and incorrect assumptions about where data is being transmitted.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The trigger conditions are broad enough to match ordinary user requests such as 'help me transcribe a video' or 'help me organize video notes,' which can cause the skill to activate in situations where the user did not intend the full workflow. Because this workflow includes automatic processing and outbound notification, overbroad triggering increases the risk of unintended data handling and disclosure.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill documents automatic email sending without clearly warning that note metadata and local file paths may be transmitted externally. This is dangerous because users may believe the workflow is local-only while the tool actually discloses sensitive filesystem and task details over email.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The script creates an output directory and invokes ffmpeg with the -y flag, which forces overwriting existing files without confirmation. If the caller points OUTPUT_DIR at a directory containing important files with matching names, prior audio segments can be silently replaced, causing data loss or destructive behavior in automation pipelines.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script unconditionally runs `pkill -f monitor_web.py`, which can terminate any process whose command line matches that string, not just the intended instance started by this skill. This is disruptive and can kill unrelated user or system workloads without warning, especially in shared environments or if another program uses the same name.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script emails task metadata including video name, output path, timestamps, and file size without a clear user-facing warning or consent flow. In a skill context, this is a privacy and data-handling risk because filenames and paths often contain sensitive project, customer, or personal information.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The documented email body includes full local video paths, output paths, and related task details, which can expose usernames, directory structures, project names, and other sensitive local metadata to external mail systems. In a tool handling personal or enterprise media, this can leak information beyond the local environment even if the media content itself is not attached.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The changelog explicitly states that completion emails are automatically sent to a hard-coded personal mailbox, which is a strong indicator of intentional exfiltration behavior. Because the workflow processes user-supplied video materials and derives metadata such as file names and paths, automatic transmission to a fixed external address creates a clear risk of unauthorized disclosure.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.