SoulDub Video Translate

• Outcome: Review
• Latest audit: Oct 18, 2026 · 1:53 PM UTC
• Version: 0.1.0

Overview

The skill mostly does what it says, but its generated authentication config can send API-key-bearing requests to a placeholder domain instead of SoulDub.

Review before installing. If you use it, verify the generated ~/.souldub/souldub.config.yaml has api_base set to the real SoulDub API endpoint before adding an API key, and only run it on MP4s you are willing to upload to SoulDub. Expect it to create local output folders, run state files, and a background process for active translations.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · references/agent-api.md (reported line 460)May include surrounding context.

md

| `INVALID_DURATION` | 400 | Invalid video duration | No |
| `IDEMPOTENCY_KEY_REUSED` | 409 | Same key reused with a different body | No, upper layer must decide |
| `IDEMPOTENCY_REQUEST_IN_PROGRESS` | 409 | Same idempotent request is still processing | Yes, retry same body and key later |
| `UPLOAD_NOT_FOUND` | 404 / 409 | Upload session missing, expired, or not in an allowed state | Depends |
| `UPLOAD_NOT_COMPLETED` | 409 | File upload is not complete | No, complete upload first |
| `TASK_NOT_FOUND` | 404 | Task missing or unauthorized | No |
| `TASK_NOT_COMPLETED` | 409 | Task is not complete | Yes, keep polling |

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/background_translate.py (reported line 89)May include surrounding context.

python

"--speaker-count",
        str(args.speaker_count),
    ]
    env = os.environ.copy()
    env["PYTHONIOENCODING"] = "utf-8"

    stdout_handle = stdout_path.open("w", encoding="utf-8")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly instructs the agent to use shell commands, read and write local files, access environment variables for API keys, and make network requests, but it declares no explicit tool scope or permission boundaries. This creates an authorization gap where the runtime may grant broader capabilities than users or platform policy expect, increasing the risk of unintended file access, command execution, or data exfiltration if the skill is misused or composed with unsafe inputs.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill is designed to persist run state across turns by storing state files, progress logs, output directories, and background-process metadata, which introduces session persistence and cross-turn state reuse. While persistence is functionally necessary here, it can expose prior user activity, allow accidental attachment to the wrong run, or leak sensitive local paths and job metadata if runs are listed or resumed without strong scoping to the current user/request.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: souldub-video-translate
description: Translate, dub, or localize local MP4 videos with SoulDub AI video translation and original-voice dubbing. Use when the user asks to translate a video into another language or Chinese dialect, AI dub an MP4, localize video content, generate translated or bilingual SRT subtitles, create a SoulDub video translation task, track long-running translation progress, or download translated video results.
license: MIT
---

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config.example.yaml (reported line 3)May include surrounding context.

yaml

# SoulDub Agent API base URL.
# The default points to the current Agent API /api/v1 root.
api_base: "https://api.souldub.ai/api/v1"

# Output directory.
# auto writes to souldub_outputs/<timestamp>-<filename-stem>/ next to the source video.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/background_translate.py (reported line 95)May include surrounding context.

python

stdout_handle = stdout_path.open("w", encoding="utf-8")
    stderr_handle = stderr_path.open("w", encoding="utf-8")
    try:
        process = subprocess.Popen(
            command,
            cwd=SKILL_DIR,
            stdin=subprocess.DEVNULL,

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 70% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/background_translate.py (reported line 111)May include surrounding context.

python

print_json(
            {
                "ok": False,
                "error": f"Failed to start background process: {exc}",
                "stdout_path": str(stdout_path),
                "stderr_path": str(stderr_path),
            }

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This JSON file consistently represents each language using only zh and en display names, which encodes a fixed bilingual locale assumption. For a general language reference used by a skill, this can amount to a language/locale policy issue if users are not offered a choice of display language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The language-resolution logic hardcodes Chinese strings such as "自动识别" and the CLI help/examples also privilege Chinese terms alongside English. This suggests a built-in locale preference rather than an explicit user-selectable locale policy, which can violate language/locale guidance when no opt-in or locale selection mechanism is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.