Security audit

Video Subtitle Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its subtitle-generation purpose, but its full pipeline can send subtitle text to a remote LLM and incur costs automatically when an API key is already present.

Review before installing. Use an isolated virtual environment, pin dependencies if possible, and do not run the full pipeline with OPENAI_API_KEY set unless you intentionally want subtitle text sent to the configured LLM provider and accept token charges. Prefer running transcription separately for sensitive videos, then explicitly choose whether to translate.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Third-Party Dependencies Permit Unreviewed Supply-Chain Changes
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/run.py:82
Finding: Full Pipeline Does Not Enforce Explicit Consent Before Remote Subtitle Transmission
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the actual implementation only operates on existing SRT files while the skill advertises end-to-end video transcription with WhisperX and language auto-detection, users and calling agents may make unsafe assumptions about what will be processed and what dependencies will be installed or invoked. Description/behavior mismatch is dangerous because it can mask real data flows, cause incorrect trust decisions, and bypass user expectations around local processing versus remote API use.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: If the actual implementation only operates on existing SRT files while the skill advertises end-to-end video transcription with WhisperX and language auto-detection, users and calling agents may make unsafe assumptions about what will be processed and what dependencies will be installed or invoked. Description/behavior mismatch is dangerous because it can mask real data flows, cause incorrect trust decisions, and bypass user expectations around local processing versus remote API use.
Content: No source excerpt is available for this finding.

os.system() or os exec-family call

High

Category: Dangerous Code Execution
Confidence: 85% confidence
Finding: os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.
Content: Scanner excerpt · scripts/run.py (reported line 21)May include surrounding context.
python
# Windows cmd.exe does not support ANSI by default; disable colors there. if sys.platform == "win32" and "WT_SESSION" not in os.environ: try: os.system("") # enable ANSI on Windows 10+ except Exception: GREEN = YELLOW = RED = NC = ""

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 21)May include surrounding context.
md
| Dependency | macOS | Linux | Windows | |-----------|-------|-------|---------| | Python 3.9+ | `brew install python` | `apt install python3` | [python.org](https://www.python.org/downloads/) | | ffmpeg | `brew install ffmpeg` | `sudo apt install ffmpeg` | `choco install ffmpeg` or `scoop install ffmpeg` | ## Resource Requirements

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
| Dependency | macOS | Linux | Windows | |-----------|-------|-------|---------| | Python 3.9+ | `brew install python` | `apt install python3` | [python.org](https://www.python.org/downloads/) | | ffmpeg | `brew install ffmpeg` | `sudo apt install ffmpeg` | `choco install ffmpeg` or `scoop install ffmpeg` | ## Resource Requirements

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documentation states 'Translate subtitles to Chinese (default)' and later reinforces that the default target language is zh. This imposes a specific language/locale preference by default rather than requiring an explicit user choice or clearly justifying the locale constraint.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 80% confidence
Finding: The skill documentation describes operations that require shell execution, environment-variable access, and reading/writing files, but it does not declare any explicit tool scope or allowed-tools boundary. This creates an authorization ambiguity where an agent may invoke broader capabilities than users expect, increasing the chance of unsafe execution or privilege creep.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The documentation states 'Translate to Chinese (default)' and defines the default target language as zh, which effectively biases output to a specific locale unless the user overrides it. The file does not explain a region-specific requirement or present this default as an explicit user choice.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/run.py (reported line 38)May include surrounding context.
python
def run_cmd(args): result = subprocess.run(args) if result.returncode != 0: sys.exit(result.returncode)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script sends subtitle text to a third-party LLM service for translation, but it does not provide an explicit warning, consent flow, or privacy notice about transmitting potentially sensitive video content off-box. In this skill context, subtitle files may contain confidential meetings, personal information, or proprietary content, so silent exfiltration to an external API creates a real privacy and compliance risk.
Content: No source excerpt is available for this finding.

Ssd 1

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Untrusted subtitle text is embedded directly into the user prompt, so adversarial subtitle content can inject instructions such as asking the model to ignore translation directions, alter output format, or include extra text. While this does not lead to code execution in the script, it can corrupt translations, break downstream parsing assumptions, and in some cases cause unintended disclosure or unreliable outputs.
Content: No source excerpt is available for this finding.

Ssd 1

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The batch prompt combines multiple untrusted subtitle lines into a single instruction context, which amplifies prompt-injection risk because one malicious subtitle can influence the model's handling of the entire batch. In this subtitle-generation context, that can cause widespread mistranslation, formatting drift, or batch parsing failure affecting many output entries at once.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The dependency whisperx is unpinned, so installs may pull different versions over time, reducing build reproducibility and increasing supply-chain risk if a newly released version introduces a vulnerability or breaking behavior. In a skill that processes media and relies on ML packages, uncontrolled upgrades can unexpectedly expose the environment to insecure transitive dependencies.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
whisperx torch torchaudio openai

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 99% confidence
Finding: The dependency torch is unpinned, which is especially risky because PyTorch is a large native-code ML framework with a history of security advisories. Without version pinning, deployments may silently install a vulnerable release or change behavior across environments, increasing supply-chain and exposure risk.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
whisperx torch torchaudio openai

Unverifiable Dependency: torch has 16 known advisory(ies) (CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: torch has multiple known advisories, and because the manifest does not pin a version, there is no way to verify whether the deployed environment avoids affected releases. This is more concerning in this skill because it processes attacker-controlled media inputs and depends on a complex native ML stack, so any vulnerable PyTorch version could increase the chance of code execution or denial-of-service paths being reachable.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency torchaudio is unpinned, so the installed version can vary between environments and over time. This weakens reproducibility and may introduce vulnerable or incompatible transitive components, particularly in a media-processing workflow that handles untrusted audio/video inputs.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
whisperx torch torchaudio openai

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency openai is unpinned, allowing uncontrolled upgrades that may introduce security issues, API-breaking changes, or altered default behaviors. Although this is less severe than a native ML library issue, it still creates avoidable supply-chain risk.
Content: Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
text
whisperx torch torchaudio openai