Wjs Dubbing Video

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:14 AM UTC
• Version: 0.1.0

Overview

The skill mostly does what it says, but it asks agents to load a broad local .env file and uses unpinned or downloaded components while sending subtitle text to external TTS services.

Review before installing. Use this only for media you are comfortable sending to third-party TTS providers. Do not source a general ~/code/.env for it; provide only VOLC_TTS_APPID and VOLC_TTS_ACCESS_TOKEN when Volcano is needed. Prefer pinned dependencies and a verified local MediaPipe model cache before running on sensitive projects.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:54

Finding

Overbroad credential loading through executable shell environment file

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:121

Finding

Unpinned third-party dependency installation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/visual_diarize.py:29

Finding

Predictable shared temporary model cache without integrity or symlink protection

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (16)

Tainted flow: 'h' from os.environ.get (line 150, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/dub.py (reported line 172)May include surrounding context.

python

},
        },
    }
    r = _rq.post(url, headers=h, json=payload, timeout=60, stream=True)
    if r.status_code != 200:
        raise RuntimeError(f"Volcano TTS HTTP {r.status_code}: {r.content[:300]!r}")
    audio = b""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a full video dubbing skill whose primary purpose is to synthesize and insert target-language speech into a video. The actual code chunk is a narrow preprocessing utility for visual diarization. While visual diarization is mentioned in the description as an optional feature for multi-speaker dubbing, this code does not perform the main advertised function at all: no speech synthesis, no voice selection, no language-specific TTS routing, no audio track generation, and no final video output. The only external access beyond local files is downloading a MediaPipe face landmark model, which is consistent with diarization but not sufficient to match the declared end-to-end dubbing behavior. Therefore this is a clear description/behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence

Finding

The skill describes capabilities that require shell, filesystem, environment-variable access, and network egress, but it does not declare any explicit tool scope or permission boundary. That creates an over-privileged execution model where an agent may invoke sensitive capabilities implicitly, increasing the blast radius of prompt injection, misrouting, or user misunderstanding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends subtitle text to external TTS providers and replaces the original audio track, but the description does not prominently disclose those behaviors up front. Users may unknowingly expose sensitive transcript content to third parties or approve a workflow that irreversibly changes media semantics without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Broad trigger phrases like generic requests for dubbing or voice-over can cause the skill to activate in contexts the user did not intend, especially in agentic routing systems. Because the skill can read local files, call external TTS services, and replace media audio, unintended invocation can lead to privacy-impacting data transmission or destructive workflow changes.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

This skill explicitly posts subtitle content and credentials-derived headers to an external TTS endpoint, which is a real external data transmission path. In the context of user-provided videos and subtitles, that can expose confidential, personal, or regulated content to a third party, and the risk is heightened because the skill encourages loading long-lived API credentials from a local .env file.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

python

import base64, json, requests
audio = b""
r = requests.post(url, headers=h, json=payload, timeout=60, stream=True)
for line in r.iter_lines():
    if not line: continue
    evt = json.loads(line)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.

text

1
00:00:00,000 --> 00:00:03,400
[A] So what about that AI rewrite thing?

2
00:00:03,400 --> 00:00:08,200

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest says the skill routes to edge-tts neural 'for any language', implying broad target-language support. In code, autodetection only looks for .zh-CN.srt and .en.srt files, and language-tag inference recognizes only zh/en/es before defaulting to 'zh', so many languages are not actually handled as described unless manually forced and even then output naming becomes misleading.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dub.py (reported line 113)May include surrounding context.

python

return out

def probe_dur(p: Path) -> float:
    r = subprocess.run(["ffprobe","-v","error","-show_entries","format=duration",
                        "-of","default=nw=1:nk=1", str(p)], capture_output=True, text=True)
    return float(r.stdout.strip())

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script sends subtitle text to third-party TTS services (ByteDance Volcano or edge-tts/Microsoft) without any explicit consent, warning, or data-classification check. If the subtitles contain sensitive, private, or regulated content, this causes unintended external disclosure to cloud providers, which is especially relevant because this skill is designed to process user-supplied media/transcripts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes this skill as producing a dub while delegating final mixing to another skill. However, the code invokes ffmpeg to combine generated audio with the source video, maps video and audio streams, encodes AAC audio, and writes the final *_dub.mp4 output itself, which is final mixing behavior rather than handoff.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/dub.py (reported line 333)May include surrounding context.

python

"-shortest", str(OUT)]

print("\nrunning ffmpeg…")
r = subprocess.run(cmd, capture_output=True, text=True)
if r.returncode != 0:
    print("FFMPEG STDERR:")
    print(r.stderr[-3000:])

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script automatically downloads a model from the internet at runtime into /tmp if it is missing. Even though the URL is hardcoded to a legitimate provider, this introduces undeclared network behavior and a supply-chain/trust boundary: execution now depends on external content availability and integrity, which is risky in security-sensitive or offline-controlled environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The CLI help and user interface do not disclose that running the tool may trigger an automatic outbound download. Lack of disclosure weakens informed consent and can violate operator expectations, especially in restricted environments where unexpected network access is treated as a security event.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The script reads the user-supplied SRT and produces a rewritten tagged SRT file, which is a file-writing operation affecting user data. The code includes no explicit warning in the description or CLI help about generating or overwriting output content beyond the bare argument name.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.