AI科普视频工作室（Mac mini 16G适用）

• Outcome: Review
• Latest audit: Jul 3, 2026 · 1:53 AM UTC
• Version: 1.0.0

Overview

This video-production skill is mostly coherent, but it asks agents to use authenticated browser sessions, biometric face and voice inputs, and runtime package installation without enough scoping or user safeguards.

Install only if you are comfortable running a media pipeline that can process local files, overwrite outputs, install Python packages at runtime, use FFmpeg on provided media, and operate through an authenticated Google browser profile. Use a dedicated project directory and browser profile, review any pip install before running it, use only voices and portraits you own or have permission to use, and avoid feeding untrusted media files or arbitrary output paths.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-shortest",
        output_path,
    ]
    subprocess.run(cmd, check=True)
    print(f"  Subtitled: {video_path} → {output_path}")

• Confidence: 88% confidence
• Finding: This ffmpeg invocation consumes both an untrusted video path and a subtitle image sequence path. Although subprocess.run is used safely without shell=True, ffmpeg itself accepts protocol handlers and complex media parsing, so attacker-controlled paths can trigger unintended network access, local file reads, or exploitation of ffmpeg/media-decoder attack surface.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

output_path,
    ])

    subprocess.run(cmd, check=True)
    print(f"Composited {len(segment_paths)} segments with {xfade}s xfade → {output_path}")

• Confidence: 88% confidence
• Finding: This final ffmpeg compositing command processes a list of attacker-influenced media segment paths through a complex filter graph. Even without shell injection, untrusted media files and ffmpeg-supported input protocols expand the attack surface to SSRF-like fetches, unsafe file access, and potential decoder/filter exploitation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if total_frames == 0:
        print(f"Warning: No subtitle frames in {subtitle_frame_dir}, skipping overlay")
        # Just copy
        subprocess.run(["ffmpeg", "-y", "-i", video_path, "-c", "copy", output_path],
                       check=True)
        return

• Confidence: 82% confidence
• Finding: This ffmpeg copy operation takes untrusted input and output paths directly. While it is not vulnerable to shell injection, ffmpeg may interpret special protocols in the input path and the output path can overwrite arbitrary files accessible to the process if upstream callers do not constrain destinations.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

for u in unified:
                f.write(f"file '{u}'\n")

        subprocess.run([
            "ffmpeg", "-y",
            "-f", "concat", "-safe", "0",
            "-i", concat_path,

• Confidence: 91% confidence
• Finding: This concat invocation uses ffmpeg with '-safe 0', which disables path safety checks for the concat demuxer. If an attacker can influence the generated concat list or upstream segment names/locations, ffmpeg may accept unsafe paths or protocol-style entries, increasing the chance of unintended file access or remote fetching.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

with tempfile.TemporaryDirectory() as tmpdir:
        for i, seg in enumerate(segment_paths):
            tmp_path = os.path.join(tmpdir, f"u_{i:02d}.mp4")
            subprocess.run([
                "ffmpeg", "-y", "-i", seg,
                "-c:v", "libx264", "-crf", "20",
                "-c:a", "aac", "-ar", "48000", "-ac", "2", "-b:a", "192k",

• Confidence: 86% confidence
• Finding: This ffmpeg transcode step processes attacker-controlled segment files. The risk is not shell injection but exposure of ffmpeg's parser/decoder surface and protocol support to untrusted inputs, which can lead to network access, local file probing, denial of service, or exploitation of ffmpeg vulnerabilities.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import whisper
    except ImportError:
        print("Installing openai-whisper...")
        subprocess.run([sys.executable, "-m", "pip", "install", "openai-whisper"],
                       check=True)
        import whisper

• Confidence: 96% confidence
• Finding: The script automatically invokes pip at runtime to install a package from an external repository when an import fails. This creates network-fetching and environment-modifying behavior during normal execution, expanding the trust boundary and exposing users to supply-chain risk, unexpected code execution from package install hooks, and non-reproducible builds.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill instructs the agent to read and write files and invoke shell tools like ffmpeg, whisper, pip, and custom scripts, but it declares no permissions. This creates a transparency and sandboxing gap: users and enforcement layers cannot accurately assess what the skill may do, increasing the risk of unintended file modification, command execution, or dependency installation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The documented behavior materially overstates the implemented pipeline while omitting actual behaviors such as Whisper use and possible auto-installation. This mismatch is dangerous because operators may trust the skill to perform sensitive stages safely or locally when those stages are absent, and may be surprised by undeclared dependency installation or data handling during transcription.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Auto-installing openai-whisper during subtitle rendering/transcription adds hidden package-fetching and environment mutation behavior beyond simple local media processing. In an agent skill context, this is more dangerous because users may run the script as part of an automated pipeline, causing unreviewed dependency retrieval and execution in trusted environments.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill provides voice cloning instructions using reference audio and transcript text but gives no warning about consent, impersonation risk, retention, or handling of biometric voice data. In this context, the omission materially increases abuse potential because the skill is specifically designed to synthesize a personal voice for video narration.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs uploading a portrait photo and relying on an active Google account context in Chrome, but does not warn about privacy, account exposure, or the sensitivity of facial images. Because this stage combines biometric data with browser-authenticated access to an external service, misuse or unclear handling could expose personal identity data or leak authenticated session activity.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The FFmpeg command includes -y, which forces overwrite of any existing output file without confirmation. In an automated content-production pipeline, if the output path is user-supplied or computed incorrectly, this can destroy existing media or other writable files, causing data loss and potentially clobbering important artifacts.

Unvalidated Output Injection

High

• Category: Output Handling

Content

def extract_audio_wav(video_path, output_path):
    """Extract audio as 16-bit PCM WAV for analysis."""
    subprocess.run([
        "ffmpeg", "-y",
        "-i", video_path,
        "-vn",

• Confidence: 83% confidence
• Finding: The code passes a user-controlled input path directly to ffmpeg as the value after -i without validating or delimiting it. While this is not shell injection, ffmpeg may treat specially crafted values such as dash-prefixed strings, protocol URLs, or unexpected input sources as options or remote resources, which can lead to unintended file access, network access, or dangerous processing of untrusted media within an automated pipeline.

Unvalidated Output Injection

High

• Category: Output Handling

Content

if total_frames == 0:
        print(f"Warning: No subtitle frames in {subtitle_frame_dir}, skipping overlay")
        # Just copy
        subprocess.run(["ffmpeg", "-y", "-i", video_path, "-c", "copy", output_path],
                       check=True)
        return

• Confidence: 77% confidence
• Finding: The issue is less 'output injection' than unvalidated filesystem/output control: output_path is used directly as ffmpeg's destination and may overwrite arbitrary files if a caller provides an unsafe path. In an automation skill that composes many artifacts, this becomes more dangerous because paths are likely derived from workflow inputs or generated metadata.

Unvalidated Output Injection

High

• Category: Output Handling

Content

with tempfile.TemporaryDirectory() as tmpdir:
        for i, seg in enumerate(segment_paths):
            tmp_path = os.path.join(tmpdir, f"u_{i:02d}.mp4")
            subprocess.run([
                "ffmpeg", "-y", "-i", seg,
                "-c:v", "libx264", "-crf", "20",
                "-c:a", "aac", "-ar", "48000", "-ac", "2", "-b:a", "192k",

• Confidence: 79% confidence
• Finding: The finding label is imprecise, but there is a real validation gap: untrusted segment paths are passed into ffmpeg for parsing/transcoding with no restrictions. In this media-production skill, user-supplied clips are a normal input, which increases practical exposure to malicious media files and protocol abuse.

Unvalidated Output Injection

High

• Category: Output Handling

Content

for u in unified:
                f.write(f"file '{u}'\n")

        subprocess.run([
            "ffmpeg", "-y",
            "-f", "concat", "-safe", "0",
            "-i", concat_path,

• Confidence: 90% confidence
• Finding: The concat stage writes a file list and then runs ffmpeg with '-safe 0', weakening ffmpeg's normal path protections. In combination with attacker-influenced file paths, this can enable unsafe path handling, arbitrary file references, or protocol-based inputs during concatenation.

Static analysis

No suspicious patterns detected.