Wjs Localizing Video

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 0.1.0

Overview

The skill is mostly a coherent video-localization orchestrator, but it includes an automatic unverified ffmpeg binary fallback and an unrelated hardcoded upload-branding rule that users should review before installing.

Install only if you are comfortable with a video pipeline that may run local media-processing commands, use TTS credentials you provide, install Python dependencies, and potentially fetch a third-party ffmpeg binary. Before use, disable or review the evermeet ffmpeg fallback, prefer a trusted local ffmpeg with libass, pin dependencies, and remove the hardcoded upload CTA rule if it does not match your channel.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:110

Finding

Automatic Retrieval and Execution of an Unverified ffmpeg Binary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:110; corroborated by README.md:264,284 and test-prompts.json:12
Vulnerability Type: Unverified remote executable retrieval
Risk Level: High

Vulnerable code snippet:

markdown

The sub-skill handles: libass availability check, evermeet static-build fallback, Fontsize calibration, frame-check before full render, audio bed mix at 0.18.

The expected test behavior makes the automatic download explicit:

json

"expected": "应该:(1) 先 ffmpeg -filters | grep subtitles 验证 libass;(2) 如果 brew ffmpeg 没 libass,自动从 evermeet.cx 拉 static build 到 /tmp 而不是 brew reinstall;..."

The README further states:

markdown

- `ffmpeg` — any version for transcribe/dub/probe; render.py
  auto-fetches a libass-enabled build if the active one is stripped.

Technical Analysis

The Skill directs a delegated rendering component to download a precompiled ffmpeg executable from evermeet.cx when the installed ffmpeg lacks libass support. The downloaded component is subsequently used to process user media.

The reviewed instructions do not require a pinned release, expected cryptographic digest, digital-signature verification, or explicit user approval. The test specification also directs the component to place the executable under /tmp, but does not prescribe a private directory, secure file creation, ownership validation, or symlink protection.

This creates a remote payload execution channel whose effective code can change after the Skill has been reviewed. Compromise of the distribution site, its release process, or the download path could substitute a malicious executable. Insecure temporary-file handling could also allow a local attacker to pre-position or replace the expected binary.

Attack Path

1. A user requests subtitle burn-in or final video rendering.
2. The delegated component checks the active ffmpeg installation and determines that libass ...[truncated 1075 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer a locally installed ffmpeg package obtained through a trusted, administratively managed package source.
• If downloading is unavoidable, pin an exact immutable release and verify a hardcoded SHA-256 or stronger digest before execution.
• Where available, verify a publisher signature against a bundled, trusted public key.
• Download into a newly created private directory with mode 0700, create files without following symlinks, and verify ownership and file type.
• Refuse to execute the artifact if any integrity, ownership, or permission check fails.
• Require explicit user approval before downloading and executing a third-party native binary.
• Cache only verified artifacts and record the version, source URL, and verified digest in an audit log.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:122

Finding

Hardcoded Third-Party Branding Influences Downstream Upload Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:122
Vulnerability Type: Unrelated downstream instruction embedded in localization workflow
Risk Level: Medium

Vulnerable code snippet:

markdown

- **Channel CTA name (if added to description): 王建硕** — never a guest's name. (Global rule from `~/.claude/CLAUDE.md`; applies when this pipeline is followed by `/wjs-uploading-video`.)

Technical Analysis

The Skill embeds a fixed personal name for use in a downstream upload description and instructs the Agent never to use a guest's name. This behavior is not required to transcribe, translate, dub, or render a video.

The instruction also relies on an external global rule from ~/.claude/CLAUDE.md, which is outside the reviewed project. Loading the localization Skill can therefore influence a later publishing task with branding that was not derived from the current user's request.

This is instruction hijacking rather than code execution: it changes the Agent's content-generation objective by imposing persistent-looking third-party attribution on a separate upload workflow.

Attack Path

1. A user invokes the Skill to localize a video.
2. The localization workflow completes and is followed by the referenced /wjs-uploading-video workflow.
3. The upload workflow adds a call to action to the video description.
4. The embedded rule causes the Agent to insert the hardcoded name instead of deriving attribution from the user's instructions or the actual channel owner.
5. The resulting content may be published with unwanted promotion or incorrect attribution.

Impact Assessment

This issue does not grant operating-system privileges or direct access to secrets. Its impact is unauthorized control over generated and potentially published content.

If the Agent is authorized to upload videos, the scope includes public-facing descriptions and associated reputational, attribution, and brand-integrity cons ...[truncated 104 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the hardcoded name and the reference to the external global instruction.
• Keep localization instructions isolated from upload, marketing, and attribution behavior.
• Derive calls to action and channel attribution only from explicit instructions in the current request.
• Require confirmation before adding promotional or attribution text to public-facing metadata.
• If reusable branding is necessary, store it in a user-controlled project configuration and display the selected value before publication.

T08 · Insecure Dependencies

Warning

• Location: README.md:77

Finding

Unpinned Python Dependencies Are Installed and Executed at Runtime

Content

View full analysis

Vulnerability Details

File Location: README.md:77-78,120,135-138
Vulnerability Type: Unpinned runtime dependency installation
Risk Level: Medium

Vulnerable code snippets:

bash

uv pip install --python .venv/bin/python mediapipe opencv-python

bash

uv pip install --python .venv/bin/python edge-tts requests

bash

uvx --from openai-whisper whisper _audio.wav \
    --language es --task transcribe \
    --model small --output_format srt --output_dir .

Technical Analysis

The setup and transcription instructions resolve third-party Python packages without exact version constraints or cryptographic hashes. The uvx --from openai-whisper command additionally installs or resolves a package and immediately executes its command-line entry point.

Because dependency selection is mutable, the code executed during a future Skill run may differ from the versions implicitly reviewed by the project author. Package-account compromise, a malicious future release, or a compromised transitive dependency could introduce arbitrary code through installation hooks, imports, or command entry points.

The package names shown are established names rather than obvious typosquats, so the audit does not establish an active malicious package. The vulnerability is the absence of reproducible, integrity-checked dependency resolution.

Attack Path

1. A user follows the documented setup or transcription workflow.
2. uv queries the configured Python package index and resolves the latest versions allowed by the unbounded package names.
3. A compromised direct or transitive package is downloaded and installed.
4. Package-controlled code runs during installation, import, or execution of the whisper entry point.
5. The malicious code executes with the permissions and environment of the Agent process.

Impact Assessment

A compromised dependency could obtain arbitrary Python-code execution ...[truncated 379 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed exact version.
• Generate and commit a lock file that records all transitive dependency versions.
• Require package hashes using a hash-locked requirements file or an equivalent uv lock workflow.
• Replace ephemeral uvx --from openai-whisper execution with installation from the reviewed lock file inside an isolated virtual environment.
• Use a trusted package index and restrict fallback or extra indexes to prevent dependency-confusion attacks.
• Run media-processing dependencies in a sandbox with minimal filesystem access, restricted environment variables, and limited network access.
• Establish an update process that reviews release changes and regenerates hashes before adopting new versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 271)May include surrounding context.

md

Optional:

- A Volcano speech-service App ID + Access Token (for Chinese dub
  quality)

## License

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README says the skill 'fires when you ask to translate a video, generate subtitles, generate a dub, etc.,' which describes activation in broad natural language rather than a specific trigger boundary. It provides no negative examples or constraints, so ordinary requests about subtitles or translation could ambiguously invoke the skill unintentionally.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

| User already has source SRT | skip ①; create only the remaining steps |
| User already has target SRT | skip ① and ②; create only the remaining |

Don't create tasks for steps you won't run — an unchecked item at the end reads as "we forgot," not "we skipped."

### How to phrase the task subjects

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The expected behavior instructs the agent to automatically download a static ffmpeg binary from an external site into /tmp and execute it when local libass support is missing. This creates a software supply-chain and arbitrary code execution risk, especially because the download occurs without user confirmation, integrity verification, or trusted package validation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The text says to respond briefly in the user's language, but the only canonical template shown is entirely in Chinese. That creates a natural-language policy risk because implementers may follow the template literally and answer in Chinese even for users who did not opt into that language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The prompt and expected behavior specify Chinese subtitles and Chinese dubbing as the required output, and the expected response explicitly mandates translation into Simplified Chinese. For a general-purpose skill, this can reflect a locale/language policy constraint without any visible user-choice mechanism or documented justification in the file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.