WJS Dubbing Video

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:47 AM UTC
• Version: 8.0.0

Overview

This skill is a small TTS dubbing guide whose behavior is disclosed and aligned with generating MP3 audio from SRT subtitles.

Install it in a virtual environment, consider pinning edge-tts to a reviewed version, and avoid using confidential subtitle text unless you are comfortable with the TTS provider handling that text.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 32
Vulnerability Type: Unpinned package installation from a mutable public package repository
Risk Level: Medium

bash

pip install edge-tts

Technical Analysis

The documented installation command retrieves the latest available version of edge-tts and its transitive dependencies from the package index. The project provides no version constraint, cryptographic hash verification, lockfile, or reviewed dependency manifest. As a result, the effective code installed by this command can change after the Skill has been audited.

This creates a supply-chain exposure if a future package release or transitive dependency is compromised. The audit found no evidence that the currently published package is malicious; the risk arises from the mutable and unverified installation procedure.

Attack Path

1. An attacker compromises the referenced package, one of its transitive dependencies, or the associated package publication account.
2. The attacker publishes a malicious release that satisfies the unrestricted installation request.
3. A user or Agent follows the Skill documentation and executes pip install edge-tts.
4. Pip downloads and installs the attacker-controlled release or dependency.
5. Malicious code executes during installation or when the package is subsequently imported or invoked.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user running pip or the TTS workflow. Depending on those privileges and the environment, the compromised package could access project files, user-readable credentials, environment variables, and network resources, or modify files available to that account. The issue does not independently provide privilege escalation beyond the invoking account.

Remediation

View remediation

Remediation Suggestions

• Pin edge-tts and every transitive dependency to reviewed versions.

• Store dependencies in a lockfile or hash-locked requirements file.

• Require cryptographic hashes during installation:

  bash

  python3 -m pip install --require-hashes -r requirements.txt
  

• Install dependencies in a dedicated, non-privileged virtual environment rather than globally or as an administrative user.

• Review dependency updates before changing pinned versions and use automated vulnerability and provenance scanning.

• Include the reviewed dependency manifest in the project so installation behavior is reproducible.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest-style description lists trigger phrases such as "dubbing" and "generate dub audio" without any scope constraints or exclusion conditions. While some phrases are specific, these English activators are broad enough to match ordinary user requests and the file provides no negative examples or narrow activation context.

Content

No source excerpt is available for this finding.