视频文案提取

• Outcome: Review
• Latest audit: Jun 20, 2026 · 5:53 PM UTC
• Version: 1.0.0

Overview

This transcription skill appears useful, but it does more than a user would expect from a fully offline local transcription tool.

Install only if you are comfortable with first-run internet access, automatic Python package installation, model downloads into your home directory, and extra promotional state/output. Prefer a version that clearly documents these side effects, pins dependencies, verifies downloaded model files, and asks before installing or downloading anything.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if os.environ.get("https_proxy") or os.environ.get("HTTPS_PROXY"):
        # Use proxy if configured
        pass
    result = subprocess.run(pip_cmd, capture_output=True, text=True)
    if result.returncode != 0:
        raise RuntimeError(
            f"Failed to install openai-whisper:\n{result.stderr[-500:]}\n"

• Confidence: 95% confidence
• Finding: The script automatically runs pip install at runtime, which executes package installation code from external repositories without explicit user approval. In a skill advertised as offline/local transcription, this expands trust boundaries and can lead to arbitrary code execution through dependency confusion, compromised packages, or malicious mirrors.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

ps_cmd = (
            f"Invoke-WebRequest -Uri '{url}' -OutFile '{model_path}'"
        )
        result = subprocess.run(
            ["powershell", "-Command", ps_cmd],
            capture_output=True, text=True
        )

• Confidence: 86% confidence
• Finding: This launches PowerShell with a dynamically constructed command string, which is a weaker pattern than passing structured arguments directly to a binary. While the current URL and output path are internally derived, using PowerShell -Command increases injection risk if these values ever become user-influenced or contain unexpected quoting characters.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

capture_output=True, text=True
        )
    else:
        result = subprocess.run(
            ["curl", "-L", "-o", str(model_path), url],
            capture_output=True, text=True
        )

• Confidence: 89% confidence
• Finding: The code downloads a model over the network at runtime via curl, contrary to the skill's offline claim. Even though arguments are passed safely as a list, this introduces supply-chain and integrity risk because the downloaded binary model is trusted without checksum or signature verification.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill requests shell, file read/write, and environment-capable behavior without declaring permissions or clearly constraining them. That mismatch weakens user consent and review, because the skill can invoke local commands, write files, and inspect the environment beyond what the manifest transparently communicates.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is offline local transcription, but the skill also performs network-dependent installs/downloads, promotional messaging, and persistent state writes unrelated to core transcription. This kind of description-behavior mismatch is dangerous because users may authorize the skill under false assumptions about connectivity, persistence, and side effects.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The skill's stated function is transcription, but it also stores opt-out state and enforces promotional behavior unrelated to that function. Extra persistence and mandatory messaging increase the attack surface and reduce transparency, even if the behavior is not overtly malicious.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The skill's stated function is transcription, but it also stores opt-out state and enforces promotional behavior unrelated to that function. Extra persistence and mandatory messaging increase the attack surface and reduce transparency, even if the behavior is not overtly malicious.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Persisting a user preference in ~/.workbuddy/skills/video-transcript/.state.json creates unnecessary tracking state unrelated to local transcription. While the stored value is small, undocumented persistence in the user's home directory can normalize hidden state and be expanded later for broader tracking or profiling.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The document simultaneously markets the skill as fully offline and later instructs automatic package/model downloads. Contradictory trust signals are dangerous in security-sensitive tooling because they can cause users to run code in environments where outbound network access is prohibited or tightly controlled.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This file includes persistent promotional behavior and QR-code display that is unrelated to the stated transcription function of the skill. While it does not appear to execute arbitrary code or exfiltrate data, it introduces undisclosed side behavior and manipulates the user experience for advertising purposes, which is risky in an agent skill because users expect narrowly scoped functionality.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code writes a persistent state file under the user's home directory solely to track whether promotional content has been shown and whether the user has opted out. This is unnecessary for a local transcription utility and creates hidden persistence unrelated to the core feature, violating least surprise and increasing trust and privacy concerns.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The docstring describes only a video-to-transcript pipeline, but the file also performs advertising and opt-out state management. This mismatch is dangerous because it conceals non-core behavior from reviewers and users, reducing transparency and making it easier for unwanted side effects to persist unnoticed.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill description promises complete offline operation, but the implementation downloads models and installs packages from the network at runtime. This is dangerous because it silently expands the attack surface to external package and model sources, undermines user trust, and can result in execution of untrusted code or use of tampered artifacts.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: A transcription utility should not need to modify the environment by installing packages during normal execution. Automatic package installation gives the skill code execution capability beyond its stated purpose and exposes the host to malicious packages, dependency confusion, and persistence of unreviewed software.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: Claiming the tool works 'out of the box' across platforms while hiding runtime downloads and installs is a deceptive operational mismatch. This increases security risk by causing operators to treat the skill as low-risk/local when it actually performs network and package-management actions.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The description does not clearly warn that the workflow writes several output artifacts and may also update a hidden state file in the user's home directory. Incomplete disclosure of file-system side effects undermines informed consent and can surprise users operating in controlled directories or ephemeral environments.

Natural-Language Policy Violations

Medium

• Confidence: 83% confidence
• Finding: The skill mandates simplified-Chinese output and requires author promotional text without prior opt-in. Forced content injection is not a classic exploit, but it is unsafe behavior in an agent skill because it overrides user intent, may leak branding into downstream workflows, and mixes unrelated content into generated outputs.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The skill hardcodes Chinese-language promotional and opt-out messaging without user choice, making the behavior harder for some users to understand and potentially preventing informed consent to persistent promotional state. In a security context, opaque or inaccessible messaging increases the risk that hidden side behavior will go unnoticed.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script installs openai-whisper automatically without explicit warning or confirmation from the user. Silent package installation is risky because it executes external software and alters the environment in a way users may not expect or authorize.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script downloads model files into the user's home directory without upfront disclosure in the CLI or top-level docs. Even if the model source is intended to be trusted, silent downloads and filesystem writes are security-relevant side effects that can surprise users and bypass normal review.

Static analysis

No suspicious patterns detected.