Security audit

视频爆款拆解与二创文案生成

Security checks for vulnerabilities and agentic risk

Overview

This skill performs the video analysis it advertises, with disclosed local downloads, dependency setup, transcription, OCR, and output files, but users should understand the network and disk impact before running it.

Install only if you are comfortable with a first run that creates a local virtualenv, installs Python packages from a remote mirror, downloads large OCR/transcription models, and stores downloaded videos plus extracted audio, frames, and transcripts in the workdir. Use a dedicated output folder and avoid giving it private or copyrighted links unless you intend those files to be downloaded and processed locally.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares no permissions, but its documented behavior includes shell execution and file writes via Python invocation, virtualenv creation, package installation, model downloads, and output generation. This is dangerous because it hides meaningful execution and filesystem capabilities from the permission model, preventing users or the platform from making an informed trust decision before the skill runs.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill description understates several high-risk behaviors: it creates a virtual environment, installs packages from an external mirror, downloads remote videos through yt-dlp, and fetches models/binaries at runtime, while implying a simpler video-analysis workflow. This mismatch is dangerous because users may supply links or run the skill without realizing it will execute setup logic and pull unpinned third-party code and content onto the local machine.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill claims to analyze videos, but it also creates a virtual environment, installs packages from a remote mirror, and re-executes itself automatically. That expands the trust boundary from local media processing to arbitrary remote code supply-chain execution, which is dangerous in an agent skill because installation happens implicitly on first run.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The manifest suggests processing an input video, but the code also accepts arbitrary URLs and fetches remote content through yt-dlp. In an agent context, this broadens behavior to external network access, possible retrieval of untrusted media, and potential policy bypass where users or upstream prompts can cause downloads from unexpected sources.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Automatically installing dependencies from an external package index during normal skill execution is a significant supply-chain risk. A compromised mirror, dependency confusion, or malicious package update could result in arbitrary code execution under the user's account without a distinct installation step or review.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill supports direct third-party video links and states that it will automatically download and process them locally, but it does not present an upfront warning about this data flow and artifact creation at the point users are likely to trigger it. This is dangerous because users may unintentionally cause local storage of downloaded media, extracted audio, frames, transcripts, and OCR text, with privacy, copyright, and disk-usage implications.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill performs network-relevant actions such as dependency installation, model downloads, and potentially later video retrieval without a clear up-front consent boundary. In an agent environment this can unexpectedly transmit metadata, consume bandwidth, and pull untrusted content, undermining user expectations and platform safety policies.

Unpinned Dependencies

Low

Category: Supply Chain
Content: faster-whisper>=1.0.0 easyocr>=1.7.0 imageio-ffmpeg>=0.4.9 yt-dlp>=2024.0.0
Confidence: 90% confidence
Finding: The dependency is specified with a lower-bound version only, which allows future installs to pull newer, unreviewed releases. This weakens reproducibility and increases supply-chain risk because a compromised or breaking upstream release could be introduced without code changes in this skill.

Unpinned Dependencies

Low

Category: Supply Chain
Content: faster-whisper>=1.0.0 easyocr>=1.7.0 imageio-ffmpeg>=0.4.9 yt-dlp>=2024.0.0
Confidence: 90% confidence
Finding: Using an unpinned dependency means installations are not deterministic and may resolve to different package versions over time. In a skill that processes untrusted media content and OCR/transcription workloads, unexpected upstream changes can introduce security defects or malicious code into the runtime.

Unpinned Dependencies

Low

Category: Supply Chain
Content: faster-whisper>=1.0.0 easyocr>=1.7.0 imageio-ffmpeg>=0.4.9 yt-dlp>=2024.0.0
Confidence: 88% confidence
Finding: A non-exact version constraint for imageio-ffmpeg permits silent upgrades to later releases, increasing supply-chain exposure. Because this package interfaces with ffmpeg binaries/media processing, consuming untrusted video input can make dependency hygiene especially important.

Unpinned Dependencies

Low

Category: Supply Chain
Content: faster-whisper>=1.0.0 easyocr>=1.7.0 imageio-ffmpeg>=0.4.9 yt-dlp>=2024.0.0
Confidence: 96% confidence
Finding: The yt-dlp dependency is unpinned, so installs may resolve to arbitrary newer versions with different behavior or newly introduced security issues. Since this skill is explicitly intended to ingest videos from external platforms, the downloader is in a high-risk path and supply-chain uncertainty is more dangerous here than in a purely local tool.

Known Vulnerable Dependency: yt-dlp==2024.0.0 — 10 advisory(ies): GHSA-3v33-3wmw-3785 (yt-dlp has dependency on potentially malicious third-party code in Douyu extract); GHSA-69qj-pvh9-c5wg (yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp); CVE-2026-55404 (yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write) +7 more

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The referenced yt-dlp version is flagged with multiple advisories, including command-injection and malicious third-party code exposure. In this skill's context, yt-dlp is likely used on attacker-controlled URLs and metadata from public video sites, which materially increases the chance that a vulnerable code path could be reached.

Static analysis

No suspicious patterns detected.