Video Subtitle Extractor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 2.0.0

Overview

This skill appears purpose-built for video transcription, but it asks for broad install, download, browser-cookie, and persistent storage behaviors that need review before use.

Install only if you are comfortable with the skill downloading media, installing system and Python dependencies, downloading ASR models, and keeping media/transcripts on disk. Avoid browser-cookie workflows unless you trust the machine and toolchain, and prefer a dedicated output directory you can delete after use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/install_deps.py:91

Finding

Unpinned Third-Party Dependencies Are Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: scripts/install_deps.py:91-123; related installation instructions appear in SKILL.md:55-59, 109, 121, 264-265 and scripts/transcribe.py:517-520
Vulnerability Type: Unpinned dependency installation and software supply-chain exposure
Risk Level: Medium

Vulnerable Code

python

def install_yt_dlp():
    """Install yt-dlp via pip."""
    try:
        import yt_dlp
        print('[OK] yt-dlp already installed')
        return True
    except ImportError:
        pass

    print('[INSTALL] yt-dlp...')
    return run([sys.executable, '-m', 'pip', 'install', 'yt-dlp', '--user'], check=False)


def install_whisper(mode='openai'):
    """Install speech-to-text engine (openai-whisper or faster-whisper)."""
    if mode == 'faster':
        try:
            import faster_whisper
            print('[OK] faster-whisper already installed')
            return True
        except ImportError:
            pass
        print('[INSTALL] faster-whisper...')
        return run([sys.executable, '-m', 'pip', 'install', 'faster-whisper', '--user'], check=False)
    else:
        try:
            import whisper
            print('[OK] openai-whisper already installed')
            return True
        except ImportError:
            pass
        print('[INSTALL] openai-whisper...')
        return run([sys.executable, '-m', 'pip', 'install', 'openai-whisper', '--user'], check=False)

The documentation also directs users to install other unpinned packages:

markdown

python scripts/install_deps.py
pip install funasr modelscope
pip install pywhispercpp

Technical Analysis

The dependency installer invokes pip using package names without reviewed version constraints, a lock file, or cryptographic hashes. Pip therefore resolves whichever compatible releases and transitive dependencies are available from the configured package ind ...[truncated 2285 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed version rather than installing unconstrained package names.
2. Generate a lock file that includes all transitive dependencies for each supported platform and Python version.
3. Record cryptographic hashes for approved distributions and install with pip --require-hashes.
4. Use an explicit trusted package index and disable unintended fallback indexes where feasible.
5. Separate optional ASR backends into individually reviewed dependency groups so users install only the backend they need.
6. Prefer prebuilt, verified wheels and prevent unreviewed source builds in production installation workflows.
7. Add automated dependency scanning and update review procedures before changing locked versions.
8. Update SKILL.md and scripts/transcribe.py so every installation example references the same locked requirements rather than direct unpinned pip install commands.
9. Keep dependency installation separate from normal Skill execution and clearly require user confirmation before installing or updating software.
10. Document model artifact sources and, where supported, verify downloaded model files against published checksums or signed manifests.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The documented behavior claims broad end-to-end capabilities including downloading from video sites, dependency installation, model download, and LLM calibration, while the analyzed implementation apparently lacks those controls or behaviors. This mismatch is dangerous because operators may trust the skill to handle network access, installation, persistence, and post-processing safely when it actually behaves differently, undermining review, consent, and security expectations.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

20p | Good balance for local storage | | 480 | ≤480p | Minimum acceptable for reference | | 360 | ≤360p | Extremely small files | | raw string | Direct yt-dlp format selector | Full flexibility |

⚠️ B站 note: Without login cookies, B站 caps at 480p. 720p+ requires --cookies-from-browser.

If download fails: the video may require cookies. Try:

bash

yt-dlp --cookies-from-browser chrome <url>

Step 2: ASR Transcription (Multi-Backend)

Run scripts/transcribe.py <audio> --backend <engine> --model <size> --language <lang>.

Three backends, auto-selected by default (priority: SenseVoice → whisper.cpp → openai-whisper):

🥇 SenseVoice Small (default for Chinese)

Property	Value
RAM	~1.5GB
Disk	~234MB
Speed	20× realtime (CPU)
Chinese accuracy	~96% 🏆
Model source	ModelScope (auto-download, no VPN needed)
Install	pip install funasr modelscope

**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

Using subprocess.run(..., shell=True) in an installer skill increases the risk of command injection or unintended command execution, especially because the skill performs package installation and may run with elevated privileges on Linux via sudo. The skill context makes this more dangerous: it is explicitly designed to auto-install dependencies across platforms, so misuse could directly alter the host system rather than only affect local application state.

Content

Scanner excerpt · scripts/install_deps.py (reported line 24)May include surrounding context.

python

if isinstance(cmd, list):
            subprocess.run(cmd, check=check, capture_output=False)
        else:
            subprocess.run(cmd, shell=True, check=check, capture_output=False)
        return True
    except subprocess.CalledProcessError:
        return False

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill advertises and documents shell execution, environment access, and file read/write behavior but does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, this makes the skill's operational authority opaque and can lead to over-broad execution, unsafe invocation, or bypass of least-privilege controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs users to use browser-cookie extraction for authenticated downloads without a clear warning about the sensitivity of those cookies. Browser cookies can grant account access and may expose session tokens to local tools, logs, or downstream processes, so recommending this flow without prominent safeguards materially increases credential and privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly states that downloaded media, transcripts, and metadata persist on disk, but it does not present this as a prominent privacy and data-retention warning. Persisting user-requested media and generated transcripts can expose sensitive content, create unexpected retention, and increase the blast radius if the host is shared or later compromised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide states to 'Always convert' traditional Chinese output to simplified Chinese, which imposes a specific locale/script policy on all applicable content. This is a natural-language policy concern because it removes user choice and does not document any opt-in, exception, or region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script automatically converts traditional Chinese text to simplified Chinese during calibration, which imposes a language/locale transformation on user content by default. Although a '--no-tradsimp' flag exists, the default behavior still applies the locale-specific conversion unless the user explicitly opts out.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill manifest centers on subtitle extraction and audio-to-text transcription, with yt-dlp used to obtain audio for ASR. This file also provides a separate download_video path that downloads and merges full MP4 video streams, which is broader than the stated subtitle/audio-extraction purpose and not presented as a necessary implementation detail for transcription.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download_audio.py (reported line 127)May include surrounding context.

python

print()

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)

        dest = None
        for line in result.stdout.splitlines():

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download_audio.py (reported line 221)May include surrounding context.

python

print()

    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
        combined_output = (result.stdout or '') + (result.stderr or '')

        # First try to find the output file from the output

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The command-line interface exposes --save-video and --video-quality, making full video acquisition a user-facing feature rather than an internal helper. That behavior exceeds the manifest's described role of extracting subtitles/transcribing audio from videos.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/install_deps.py (reported line 22)May include surrounding context.

python

"""Run a shell command and return success."""
    try:
        if isinstance(cmd, list):
            subprocess.run(cmd, check=check, capture_output=False)
        else:
            subprocess.run(cmd, shell=True, check=check, capture_output=False)
        return True

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 92% confidence

Finding

This branch executes string commands with shell=True, which allows shell parsing and command chaining if the command string is ever influenced by untrusted input. In this script, the current callers appear mostly hardcoded, but the helper is generic and already accepts arbitrary cmd values, making it an unsafe primitive for an agent skill that installs software and may evolve to consume external parameters.

Content

Scanner excerpt · scripts/install_deps.py (reported line 24)May include surrounding context.

python

if isinstance(cmd, list):
            subprocess.run(cmd, check=check, capture_output=False)
        else:
            subprocess.run(cmd, shell=True, check=check, capture_output=False)
        return True
    except subprocess.CalledProcessError:
        return False

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The pipeline function defaults language='zh', which imposes a specific locale by default rather than detecting or asking for the user's preferred language. This matches the policy category for language/locale constraints because the file does not justify the restriction as region-specific or require explicit opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The command-line interface sets --language to zh by default, meaning the skill will operate in a specific language unless the user overrides it. This is a natural-language locale policy issue because the user is not first offered a neutral default or explicit opt-in.

Content

No source excerpt is available for this finding.

Tainted flow: 'path' from os.environ.get (line 294, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/transcribe.py (reported line 131)May include surrounding context.

python

def _write_srt(segments, path):
    """Write SRT subtitle file."""
    with open(path, 'w', encoding='utf-8') as f:
        for i, seg in enumerate(segments, 1):
            start = _fmt_timestamp(seg['start'])
            end = _fmt_timestamp(seg['end'])

Tainted flow: 'path' from os.environ.get (line 294, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/transcribe.py (reported line 140)May include surrounding context.

python

def _write_srt(segments, path):
    """Write SRT subtitle file."""
    with open(path, 'w', encoding='utf-8') as f:
        for i, seg in enumerate(segments, 1):
            start = _fmt_timestamp(seg['start'])
            end = _fmt_timestamp(seg['end'])

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The command-line interface sets --language to zh by default, which imposes a specific language/locale choice on users unless they explicitly override it. This matches the policy category for language or locale constraints without opt-in, especially since the tool also advertises multi-language support elsewhere in the file.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 7)May include surrounding context.

text

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.