Manim Animation En

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:48 AM UTC
• Version: 1.0.3

Overview

This skill is a coherent Manim video-generation helper, with some privacy and dependency-installation caveats users should understand before use.

Install this in a virtual environment or container, review package sources before installing optional TTS backends, and avoid sending confidential narration to gTTS or other cloud TTS providers unless you are comfortable with that provider processing the text. Use the offline pyttsx3 backend when privacy matters.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:61

Finding

Unpinned Third-Party Dependencies and Mutable Package Sources

Content

View full analysis

=69.0,<72.0" ``` From `references/manim_guide.md:108-112`: ```markdown | **gTTS** | `pip install "manim-voiceover[gtts]"` | Free | Required | Medium | ✅ | | **pyttsx3** | `pip install "manim-voiceover[pyttsx3]"` | Free | Not required | Lower | ✅ | | **Azure** | `pip install "manim-voiceover[azure]"` | Paid | Required | High | ✅ | | **OpenAI** | `pip install "manim-voiceover[openai]"` | Paid | Required | High | ✅ | | **ElevenLabs** | `pip install "manim-voiceover[elevenlabs]"` | Paid | Required | Very High | ✅ | ``` From `references/manim_guide.md:345-347`: ```bash brew tap homebrew-ffmpeg/ffmpeg brew install homebrew-ffmpeg/ffmpeg/ffmpeg-full brew link --force ffmpeg-full ``` From `scripts/check_environment.py:68-79`: ```python def check_python_package(package, import_name=None, install_hint=None): """Check if a Python package is importable.""" import_name = import_name or package try: mod = importlib.import_module(import_name) version = getattr(mod, '__version__', 'installed') print(f" {check_mark(True)} {package}: {version}") return True except ImportError: hint = install_hint or f"pip install {package}" print(f" {check_mark(False)} {package}: NOT FOUND") print(f" Install: {hint}") return False ``` ### Technical Analysis The installation instructions retrieve packages by mutable package name without exact version pins ...[truncated 2210 chars]

Remediation

View remediation

other

Note

• Location: SKILL.md:15

Finding

Default Cloud TTS Processing Conflicts with Local-Processing Claim

Content

View full analysis

max_width: sub.scale_to_fit_width(max_width) sub.to_edge(DOWN, buff=0.4) bg = BackgroundRectangle(sub, color=BLACK, fill_opacity=0.6, buff=0.15) return VGroup(bg, sub) def construct(self): self.set_speech_service(GTTSService(lang="en")) ``` From `references/manim_guide.md:108`: ```markdown | **gTTS** | `pip install "manim-voiceover[gtts]"` | Free | Required | Medium | ✅ | ``` ### Technical Analysis The metadata correctly identifies Google TTS as a network service and states that gTTS is the default engine. Nevertheless, the overview broadly claims that all processing runs locally. The supplied scene template configures `GTTSService`, whose operation requires sending narration text to Google's TTS servic ...[truncated 1520 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (17)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/manim_guide.md (reported line 139)May include surrounding context.

md

manim-voiceover caches generated TTS audio in the `media/voiceovers/` directory:
- Identical text will not be regenerated
- Modified text triggers automatic regeneration
- Clear cache: `rm -rf media/voiceovers/`

### SRT Subtitle Auto-Generation

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to read and write files and execute shell commands (python3, manim, ffmpeg, package installs) but does not declare any explicit tool scope such as allowed tools or permissions. This creates a governance gap: an agent may invoke powerful capabilities without clear restriction, increasing the chance of unintended command execution or file modification when handling user prompts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger description is broad enough to match generic requests like 'create animation video' or educational video generation, which could cause the skill to activate in contexts beyond narrow Manim use. Over-broad activation is dangerous because this skill carries shell, file-write, and optional network behaviors, so accidental invocation can expose users to unnecessary execution risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md

- **FFmpeg (with libx264 + libass)**: Manim hardcodes the `libx264` encoder for video rendering; subtitle burn-in requires `libass`
  - macOS (Homebrew): `brew install ffmpeg` (includes x264 and libass by default)
  - macOS (Conda): `conda install x264 -c conda-forge` (**⚠️ conda's ffmpeg does not include libx264 by default**)
  - Linux: `sudo apt install ffmpeg libx264-dev libass-dev`
- **Python 3.9+** and pip

### Required Python Packages

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.

md

- **FFmpeg (with libx264 + libass)**: Manim hardcodes the `libx264` encoder for video rendering; subtitle burn-in requires `libass`
  - macOS (Homebrew): `brew install ffmpeg` (includes x264 and libass by default)
  - macOS (Conda): `conda install x264 -c conda-forge` (**⚠️ conda's ffmpeg does not include libx264 by default**)
  - Linux: `sudo apt install ffmpeg libx264-dev libass-dev`
- **Python 3.9+** and pip

### Required Python Packages

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/check_environment.py (reported line 156)May include surrounding context.

python

- **FFmpeg (with libx264 + libass)**: Manim hardcodes the `libx264` encoder for video rendering; subtitle burn-in requires `libass`
  - macOS (Homebrew): `brew install ffmpeg` (includes x264 and libass by default)
  - macOS (Conda): `conda install x264 -c conda-forge` (**⚠️ conda's ffmpeg does not include libx264 by default**)
  - Linux: `sudo apt install ffmpeg libx264-dev libass-dev`
- **Python 3.9+** and pip

### Required Python Packages

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.

Linux:

bash

sudo apt install libass-dev
# May need to recompile ffmpeg

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/manim_guide.md (reported line 394)May include surrounding context.

Linux:

bash

sudo apt install libass-dev
# May need to recompile ffmpeg

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The guide recommends network-backed TTS providers such as gTTS, Azure, OpenAI, and ElevenLabs without warning that narration text will be transmitted to third-party services. In this skill context, users may supply proprietary scripts, internal educational content, or personal information for voiceover generation, so omission of a privacy notice can lead to unintended data disclosure.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_environment.py (reported line 24)May include surrounding context.

python

def run_cmd(cmd_args, capture=True):
    """Run a command as argument list (shell=False) and return (success, output)."""
    try:
        result = subprocess.run(
            cmd_args, capture_output=capture, text=True, timeout=30
        )
        return result.returncode == 0, result.stdout.strip()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_environment.py (reported line 35)May include surrounding context.

python

def run_pipe(cmd1_args, cmd2_args):
    """Run two commands connected by a pipe (safe, no shell). Returns (success, output)."""
    try:
        p1 = subprocess.Popen(cmd1_args, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
        p2 = subprocess.Popen(cmd2_args, stdin=p1.stdout, stdout=subprocess.PIPE, text=True)
        p1.stdout.close()
        output, _ = p2.communicate(timeout=30)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_environment.py (reported line 36)May include surrounding context.

python

"""Run two commands connected by a pipe (safe, no shell). Returns (success, output)."""
    try:
        p1 = subprocess.Popen(cmd1_args, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
        p2 = subprocess.Popen(cmd2_args, stdin=p1.stdout, stdout=subprocess.PIPE, text=True)
        p1.stdout.close()
        output, _ = p2.communicate(timeout=30)
        return p2.returncode == 0, output.strip()

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script contains a dedicated 'Chinese Fonts' check and warns that rendering may fail without Chinese fonts, which imposes a specific language/locale expectation in the skill's behavior. There is no nearby natural-language indication that Chinese support is optional, user-selected, or justified as a region-specific requirement.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_pipeline.py (reported line 62)May include surrounding context.

python

# Display the command in a human-readable form
    display_cmd = " ".join(shlex.quote(str(a)) for a in cmd_args)
    print(f"  $ {display_cmd}\n")
    result = subprocess.run(cmd_args, cwd=cwd)
    return result.returncode == 0

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_pipeline.py (reported line 295)May include surrounding context.

python

else video_file
        )
        if sys.platform == "darwin":
            subprocess.run(["open", preview_file])
        elif sys.platform == "linux":
            subprocess.run(["xdg-open", preview_file])

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_pipeline.py (reported line 297)May include surrounding context.

python

if sys.platform == "darwin":
            subprocess.run(["open", preview_file])
        elif sys.platform == "linux":
            subprocess.run(["xdg-open", preview_file])

    # Summary
    print(f"\n{'='*60}")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The example hardcodes GTTSService(lang="en"), which forces English output in natural-language guidance. Since the document also discusses Chinese support elsewhere, the language choice appears incidental rather than justified, and no opt-in or configurable alternative is presented at that point.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.