Security audit
Security checks for vulnerabilities and agentic risk
This skill is a local video-production workflow whose file, terminal, audio, and rendering behavior matches its stated purpose.
Install this only where you are comfortable allowing a skill to run local render commands, write project/output files, and process a music file you provide. Use music and fonts you have rights to use, and prefer an isolated project environment for npm/pip dependencies.
声明描述的是一个视频生产技能：围绕主题制作 Vibe 风格无旁白知识视频，并完成核查、动画、音乐与最终 MP4 交付。而实际代码没有执行任何与视频创作或导出相关的流程，只做本地只读依赖检查：验证 Python/Node/ffmpeg/ffprobe 和若干 Python/Node 依赖是否存在、版本是否满足要求、以及中文字体/canvas 支持是否可用。虽然这些检查可能是视频生产前的辅助准备步骤，但该代码块的主要目的与声明的核心功能明显不同，因此属于描述与行为不匹配。
The skill explicitly expects broad capabilities including file access, terminal execution, web research, and environment access, but it does not declare a restrictive tool scope such as permissions or allowed-tools. This weakens sandboxing and reviewability: an agent may grant more power than necessary, making accidental or unsafe file, shell, or network actions easier if the skill is misused or later modified.
The markdown specifies '中文' as a default output requirement, which imposes a language choice on the user. The policy allows language constraints only when the user is given a choice or the restriction is clearly justified as region-specific, neither of which is stated here.
The default prompt invokes the skill with an open-ended theme ('如果光速突然变慢') and no visible constraints on scope, safety checks, or required user confirmation. Combined with allow_implicit_invocation=true, this increases the chance the agent will trigger the skill automatically in loosely related contexts, causing unintended generation actions or bypassing clearer user intent boundaries.
The instruction explicitly prioritizes Chinese fonts and Chinese character-count timing, which imposes a specific language/locale expectation in the skill guidance. The file does not offer opt-in, alternatives for other languages, or a documented reason that this skill is limited to Chinese-language output.
This markdown file contains user-facing instructions exclusively in Chinese, which can constitute a language/locale policy violation when no opt-in or alternative language is provided. The document does not state that the skill is intentionally limited to Chinese-speaking users or a region-specific context.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
ff=shutil.which('ffmpeg')
if not ff:p.error('ffmpeg not found')
sr=22050
raw=subprocess.check_output([ff,'-v','error','-ss',str(a.start),'-i',a.audio,'-t',str(a.duration),'-vn','-ac','1','-ar',str(sr),'-f','s16le','pipe:1'])
x=np.frombuffer(raw,dtype='<i2').astype(float)/32768
if len(x)<sr or np.max(np.abs(x))<1e-5:p.error('audio too short or silent')
f,t,z=stft(x,sr,nperseg=1024,noverlap=768);m=np.abs(z)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
for binary in ['node','ffmpeg','ffprobe']:
path=shutil.which(binary);checks[binary]={'ok':bool(path)}
if path:
r=subprocess.run([path,'--version'if binary=='node'else '-version'],capture_output=True,text=True)
checks[binary]['version']=(r.stdout or r.stderr).splitlines()[0]
if binary=='node':checks[binary]['ok']=int(checks[binary]['version'].lstrip('v').split('.')[0])>=20
node=shutil.which('node')
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
node=shutil.which('node')
if node and project.is_dir():
code="""const path=require('path');const m=require(require.resolve('@napi-rs/canvas',{paths:[process.argv[1]]}));const f=process.env.VIBE_FONT_PATH;const registered=f?m.GlobalFonts.registerFromPath(f,'VibeCJK'):null;const cn=registered?'VibeCJK':['Noto Sans CJK SC','Noto Sans SC','Source Han Sans SC','Hiragino Sans GB','PingFang SC','Microsoft YaHei'].find(x=>m.GlobalFonts.has(x));console.log(JSON.stringify({canvas:true,cjk_font:cn||null}));if(!cn)process.exitCode=2;"""
r=subprocess.run([node,'-e',code,str(project)],capture_output=True,text=True)
try:detail=json.loads(r.stdout.strip())
except ValueError:detail={'canvas':False,'cjk_font':None}
checks['canvas_and_cjk']={'ok':r.returncode==0,**detail}
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if out.exists() and not a.overwrite:p.error('output exists; choose a new name or explicitly pass --overwrite')
if out in [Path(x).resolve()for x in [a.silent,a.music,a.sfx]if x]:p.error('output must not replace an input')
def run(args):
r=subprocess.run(args,text=True,capture_output=True)
if r.returncode:raise RuntimeError(r.stderr[-6000:])
return r
The dependency specification for numpy uses a broad version range rather than a fully pinned version, so builds may resolve to different releases over time, including versions with known advisories depending on the installer state. This creates supply-chain uncertainty and makes it impossible to verify from the manifest alone whether a vulnerable version could be installed.
The scipy requirement is only range-constrained, not fixed to an exact release, so the environment may install different versions across time or systems. Because scipy has historical advisories, this lack of pinning prevents reliable verification that deployed environments avoid affected releases.
Pillow is specified with a version range instead of an exact pinned release, which leaves room for installation of different versions with different security posture. This is more concerning for an image-processing package because some Pillow advisories involve malformed image parsing and potential code execution or denial of service when handling untrusted media.
This code creates parent directories and writes a JSON file to the path supplied by --output, which can modify the filesystem. While the operation is part of the script's apparent purpose, there is no inline comment, log before writing, or confirmation prompt disclosing that directories may be created and files overwritten.
Detected: suspicious.dangerous_exec