WJS Burning Subtitles

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:42 AM UTC
• Version: 8.0.0

Overview

This subtitle-rendering skill has a coherent media purpose, but it can automatically download and run an unpinned third-party ffmpeg binary from a shared temporary path.

Install only if you are comfortable with the skill running ffmpeg over your local media files and with its current fallback behavior. Prefer installing a trusted system ffmpeg with libass yourself, set a pinned EVERMEET_FFMPEG_SHA256 if the fallback is used, and avoid using this skill on shared machines until the /tmp executable caching issue is fixed.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/render.py:53

Finding

Unverified Remote Executable Is Automatically Downloaded and Executed

Content

View full analysis

bool: r = subprocess.run([ff, "-filters"], capture_output=True, text=True) return any(" subtitles " in line for line in r.stdout.splitlines()) def fetch_static_ffmpeg() -> str: if not os.environ.get("EVERMEET_FFMPEG_SHA256"): print( "⚠ WARNING: downloading ffmpeg binary from evermeet.cx without" " SHA256 verification.\n" " Set EVERMEET_FFMPEG_SHA256 env var to pin a known-good build.\n" " Recommended: install ffmpeg with libass via your package manager" " instead.\n" " macOS: brew install ffmpeg\n" " Linux: apt install ffmpeg\n" " Windows: winget install ffmpeg\n", file=sys.stderr, ) print("→ downloading libass-enabled ffmpeg from evermeet.cx…", file=sys.stderr) STATIC_FF.parent.mkdir(parents=True, exist_ok=True) z = "/tmp/ff_evermeet.zip" # Retry with exponential backoff (evermeet.cx can be flaky) last_err = None for attempt in range(3): try: urllib.request.urlretrieve(EVERMEET_URL, z) break except (urllib.error.URLError, OSError) as e: last_err = e if attempt < 2: wait = 2 ** attempt print(f" downlo ...[truncated 3653 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/render.py:128

Finding

Predictable Shared Temporary Executable Path Allows Local Tool Spoofing

Content

View full analysis

str: if STATIC_FF.exists(): return str(STATIC_FF) sys_ff = shutil.which("ffmpeg") or "ffmpeg" if not need_libass: return sys_ff if libass_ok(sys_ff): return sys_ff return fetch_static_ffmpeg() ``` ### Technical Analysis The script stores and reuses an executable at the fixed path `/tmp/ff_bin/ffmpeg`. If this path already exists, `pick_ffmpeg()` trusts it immediately without checking: - File ownership - Directory ownership and permissions - Whether the path is a regular file or a symbolic link - Whether the executable was created by this Skill - The executable's checksum or signature On systems where `/tmp` is shared, an attacker can pre-create `/tmp/ff_bin` and place an attacker-controlled `ffmpeg` at the expected path before the legitimate user runs the Skill. The usual sticky-bit protection on `/tmp` does not prevent an attacker from creating a previously absent, attacker-owned subdirectory with a predictable name. The archive path `/tmp/ff_evermeet.zip` is also fixed, creating additional race and replacement opportunities. The executable is effectively treated as a trusted local tool solely because it exists at a predictable location. This is a tool-spoofing issue rather than shell command injection. The script correctly supplies subprocess arguments ...[truncated 1564 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (8)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The script auto-downloads an ffmpeg zip from evermeet.cx into /tmp and executes the extracted binary; by default, integrity verification is not enforced. That creates a direct remote-binary execution path, so any compromise of the host, TLS interception edge case, mirror/CDN issue, or local /tmp tampering could result in arbitrary code execution on the machine running the skill.

Content

Scanner excerpt · scripts/render.py (reported line 56)May include surrounding context.

python

EVERMEET_URL = "https://evermeet.cx/ffmpeg/getrelease/zip"
# SHA256 of the known-good evermeet.cx static ffmpeg release (universal binary).
# Update this when bumping the ffmpeg version. To obtain:
#   curl -sL https://evermeet.cx/ffmpeg/getrelease/zip | shasum -a 256
EVERMEET_SHA256 = os.environ.get(
    "EVERMEET_FFMPEG_SHA256",
    "",  # empty = skip check (set to pin a specific build)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill clearly instructs use of shell commands, network download, and environment-dependent binaries, but it declares no explicit tool restrictions or permission scope. In an agent setting, this increases the chance the skill is invoked with broader-than-necessary capabilities, enabling unintended command execution or remote retrieval without clear policy boundaries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description declares trigger phrases such as "burn subtitles", "embed subtitle", and "做最终合成" without any explicit exclusion conditions or constrained activation context. While some triggers are domain-related, several are generic enough that they could overlap with normal conversation or unrelated media-editing requests, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The skill instructs downloading and executing a third-party ffmpeg binary from the internet into /tmp without checksum verification, signature validation, pinning, or trust controls. This creates a supply-chain and remote code execution risk: if the source, connection path, or downloaded artifact is compromised, the agent may run attacker-controlled code.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Fastest fix on macOS — drop in a static build, no system changes

bash

curl -fsSL -o /tmp/ff.zip https://evermeet.cx/ffmpeg/getrelease/zip
unzip -o /tmp/ff.zip -d /tmp/ff_bin >/dev/null
FF=/tmp/ff_bin/ffmpeg
$FF -version | grep -oE -- "--enable-(libass|libfreetype)"

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The docstring claims SHA256 verification protects the downloaded ffmpeg build, but the code sets the expected hash to an empty default and explicitly skips verification unless an environment variable is provided. In this skill's context, the script automatically downloads and later executes a third-party binary, so optional verification materially increases supply-chain compromise risk and can lead to arbitrary code execution.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render.py (reported line 65)May include surrounding context.

python

def libass_ok(ff: str) -> bool:
    r = subprocess.run([ff, "-filters"], capture_output=True, text=True)
    return any(" subtitles " in line for line in r.stdout.splitlines())

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render.py (reported line 233)May include surrounding context.

python

cmd += ["-c:a","aac","-b:a", f"{a.audio_bitrate}k", a.out]

    print(" ".join(cmd), file=sys.stderr)
    r = subprocess.run(cmd)
    sys.exit(r.returncode)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The markdown recommends PingFang SC and frames line-length rules specifically around Chinese output, but does not clearly state that these settings are examples for Chinese-language jobs only or that users can choose another locale/font. This can be read as a default locale preference rather than an opt-in regional configuration.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.