T09 · Insecure Skill Coding Practices
Error
- Location
scripts/transcribe.py:24- Finding
Predictable temporary audio path causes unintended file upload and deletion
- Content
View full analysis
- Remediation
View remediation
Security audit
transcribe-video
Security checks for vulnerabilities and agentic risk
Overview
This video transcription skill has a coherent purpose, but its bundled script can accidentally upload and delete an existing same-name WAV file and overwrite same-name text files without confirmation.
Install only if you are comfortable sending audio to OpenAI or Azure OpenAI when embedded subtitles are absent. Before use, make sure there is no important same-name .wav or .txt file beside the selected video, because this version may upload/delete the WAV and overwrite the TXT without asking. Store ~/.transcribe_video.env with restricted permissions and prefer pinned dependencies in a virtual environment.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/transcribe.py:25- Finding
Existing transcript files are overwritten without confirmation
- Content
View full analysis
- Remediation
View remediation
.transcript.txt`. - Generate a numbered or unique output path when the preferred destination already exists. - Use exclusive creation mode to eliminate check-to-write races. - If replacement is explicitly authorized, write to a temporary file and atomically replace the destination only after successful completion. Example exclusive-write approach: ```python output_path = video_path.with_name(f"{video_path.stem}.transcript.txt") try: with output_path.open("x", encoding="utf-8") as output_file: output_file.write(transcript_text) except FileExistsError: raise RuntimeError( f"Refusing to overwrite existing transcript: {output_path}" ) ``` ]]>
T08 · Insecure Dependencies
Note
- Location
SKILL.md:68- Finding
Documentation instructs installation of unpinned runtime dependencies
- Content
View full analysis
- Remediation
View remediation
--hash=sha256: python-dotenv== --hash=sha256: ``` Install with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill invokes shell commands, reads environment-backed credentials, and writes output files, but it does not declare any explicit tool scope or permissions boundaries. That increases the chance of overbroad execution in hosts that rely on manifest-level permission gating, making shell/file/env access less auditable and easier to misuse if the skill is triggered unexpectedly.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger conditions are broad enough to activate on common phrases like "transcribe" or generic requests for a script/transcript from a video file. Overbroad invocation can cause the agent to enter a workflow that runs shell commands and may upload audio to an external API without the user specifically intending this skill, increasing risk from unintended execution and data handling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill directs extracted audio to an external transcription API but does not require an explicit user-facing notice or consent step before transmission. Because video audio may contain sensitive or regulated content, silent off-device transfer creates a real privacy and compliance risk, especially when the user may expect purely local processing.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
The skill instructs use of a persistent credentials file in the home directory, which creates session persistence for sensitive API configuration beyond the immediate task. While common operationally, persistent secret storage can broaden exposure if the environment is shared, backed up insecurely, or later accessed by other tools without clear scoping.
- Content
test -f ~/.transcribe_video.env && echo "OK" || echo "MISSING"
text 2. If MISSING, tell the user to create `~/.transcribe_video.env` with:OPENAI_API_KEY=your-key-here
Optional Base URL:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # Extract audio if not audio_path.exists(): print(f"Extracting audio from {video_path}...") subprocess.run( ["ffmpeg", "-i", str(video_path), "-vn", "-acodec", "pcm_s16le", "-ar", "16000", "-ac", "1", str(audio_path), "-y"], check=True, capture_output=True,
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Although the skill is described as handling local video files, it transmits extracted audio to OpenAI or Azure OpenAI for transcription. This creates a material data exfiltration/privacy risk because users may reasonably expect local-only processing while potentially sensitive spoken content leaves the host and is sent to a third-party service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code uploads audio content to a remote transcription API without any explicit user-facing warning at the point of use. In a transcription workflow, audio often contains sensitive personal, business, or regulated information, so silent transmission increases the risk of privacy violations and noncompliant handling of user data.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The script loads credentials from ~/.transcribe_video.env before processing the video. Accessing a hidden file in the user's home directory to retrieve secrets is an additional capability not described in the manifest, which only describes extracting transcripts from local video files.
- Content
Static analysis
No suspicious patterns detected.