video-overlay-cleanup-agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:49 AM UTC
• Version: 1.0.1

Overview

The skill is mostly purpose-aligned video cleanup tooling, but its cleanup and extension mechanisms create real data-loss and command-execution risks that should be reviewed before installation.

Review this before installing or running on important data. Use Gemini mode only when you intend to send video frames and masks to Google, use only trusted editor commands, and do not pass an existing or valuable directory as --workdir unless the cleanup behavior has been fixed or contained.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/clean_video.sh:101

Finding

Arbitrary Recursive Deletion Through a User-Controlled Work Directory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/clean_video.sh:59

Finding

Predictable Work Directory Permits Symlink-Based File Overwrite and Environment-File Tampering

Content

View full analysis

/dev/null if [[ -f "$RUN_ADVICE_ENV" ]]; then # shellcheck disable=SC1090 source "$RUN_ADVICE_ENV" fi fi ``` ```python def write_pgm(path: Path, width: int, height: int, rows): with path.open("w", encoding="ascii") as fh: fh.write("P2\n") fh.write(f"{width} {height}\n") fh.write("255\n") ``` ```python workdir = Path(args.workdir).resolve() learnings_path = Path(args.persistent_learnings).resolve() run_advice_path = workdir / "run_advice.json" run_advice_md_path = workdir / "run_advice.md" run_advice_env_path = workdir / "run_advice.env" ``` ```python shell_lines = [ f"LEARNED_REQUEST_RETRIES={dump_shell_value(str(recommended_request_retries))}", f"LEARNED_CONCURRENCY={dump_shell_value(str(recommended_concurrency))}", f"LEARNED_PROMPT_ADDENDUM={dump_shell_value(' '.join(prompt_addendums))}", ] run_advice_env_path.write_text("\n".join(shell_lines) + "\n", encoding="utf-8") ``` ### Technical Analysis The default ...[truncated 2734 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:6

Finding

Third-Party Python Dependencies Are Not Version-Pinned

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description centers on cleaning videos by removing overlays and orchestrating media-editing workflows. However, the supplied code does not process video, frames, masks, overlays, or FFmpeg at all. Its primary purpose is to prepare execution advice from prior run data: it loads persistent learnings, derives recommended retries/concurrency/prompt hints, and emits advisory files. That is a materially different function from the declared media-cleanup behavior, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The script reads an API key from the environment and uses it to call an external model service, but the static finding indicates this environment access is not declared in the skill's permissions. In an agent-skill context, undeclared secret access is dangerous because it can bypass user/operator expectations about what sensitive data the skill can read and use, especially when the skill also transmits local image data to a third-party API.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/restore_frames.py (reported line 51)May include surrounding context.

python

prompt_tokens * GEMINI_31_FLASH_IMAGE_PREVIEW_INPUT_PRICE_PER_M / 1_000_000
        + output_tokens * GEMINI_31_FLASH_IMAGE_PREVIEW_OUTPUT_PRICE_PER_M / 1_000_000
    )
    return prompt_tokens, output_tokens, cost


def retry_summary(usage_payload: dict) -> tuple[int, list[str]]:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly states that original frames and masks are sent to Gemini, but it does not clearly warn users that potentially sensitive video content will leave the local environment and be transmitted to a third-party service. In a video-cleanup workflow, frames may contain confidential screens, personal notifications, or embedded identifiers, so omission of a privacy/data-sharing warning can lead to unintentional disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file applies to SQP-2, and it states that the script executes an external command for each frame. The document explains the contract but does not warn users that arbitrary provider commands will be run repeatedly, which can affect system integrity or invoke untrusted tooling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sources a generated env file from the workdir directly into the current shell with source "$RUN_ADVICE_ENV". Even though the file is produced by a helper script, it is treated as executable shell syntax rather than parsed as data, so any compromise of that file path, helper script, or workdir contents can lead to arbitrary command execution in the context of the user running the skill. In a media-processing skill, this behavior is broader than necessary and increases risk substantially.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

In gemini-nano-banana mode, the script extracts frames from the input video and invokes an API-backed editor using GEMINI_API_KEY, which can transmit video frames to an external service. The script does not present an explicit user-facing warning, confirmation, or privacy notice at the point of execution, so sensitive screen recordings or videos could be exfiltrated off-device unexpectedly. Because this skill is specifically for cleaning screen recordings and overlays, the content is especially likely to contain sensitive notifications, status bars, or other private UI elements.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/gemini_nano_banana_edit.py (reported line 54)May include surrounding context.

python

temp_dir = Path(tempfile.mkdtemp(prefix="gemini-mask-"))
    converted = temp_dir / "mask.png"
    subprocess.run(
        [
            "ffmpeg",
            "-y",

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill accepts an arbitrary external command template at runtime and applies it across a batch of files, which exceeds the narrowly described overlay-removal function. This broad execution surface means a user or upstream agent can turn the skill into a general-purpose command runner, enabling destructive actions, data access, or network-capable tooling unrelated to frame restoration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script is designed to execute externally supplied commands but provides no built-in safety barrier, warning, or trust restriction around that capability. While this is partly a product-safety issue rather than a code-injection bug by itself, in an agent setting it increases the chance that unsafe commands are passed through and executed without scrutiny.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 95% confidence

Finding

The script executes a runtime-supplied command template via subprocess after only tokenizing it with shlex.split. This allows the caller to run any local program against every frame, which is effectively arbitrary command execution within the privileges of the process. In the context of an agent skill, that is dangerous because the skill's stated purpose is video cleanup, but the implementation can be repurposed to execute unrelated system commands.

Content

Scanner excerpt · scripts/restore_frames.py (reported line 127)May include surrounding context.

python

usage_output=str(usage_path) if usage_path else "",
        )
        try:
            subprocess.run(shlex.split(command), check=True)
        except subprocess.CalledProcessError as exc:
            raise SystemExit(
                f"Frame editor failed on frame {frame.name} with exit code {exc.returncode}: {command}"

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code persists multiple files to disk, including run_summary.json, self_improve.md, and an optional persistent learnings file. Those outputs include resolved filesystem paths, frame statistics, and estimated spend, but the script provides no confirmation prompt or explicit user-facing warning before creating or updating them.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.