Security audit

Wjs Segmenting Video

Security checks for vulnerabilities and agentic risk

Overview

The skill’s main video-segmentation workflow is understandable, but the package includes under-disclosed post-production and external image-generation capabilities that go beyond its stated cut-and-crop purpose.

Review this before installing. The segmentation path itself is plausible, but the package also contains cover generation, subtitle burn-in, intro-prepending, external image-provider use, and weak ffmpeg/dependency trust assumptions. Install only if you expect those broader media-production capabilities, use isolated project directories, avoid shared /tmp ffmpeg binaries, pin dependencies, and require explicit approval before sending frames or prompts to any external provider.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/burn_subs.py:110
Finding: Executable Hijacking Through a Predictable Shared Temporary Path
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:185
Finding: Unpinned Python Dependencies and Unverified External FFmpeg Distribution
Content: View full analysis
Remediation: View remediation

other

Warning

Location: scripts/make_cover.py:63
Finding: External Transmission of Video Frames and Transcript-Derived Metadata Without Workflow-Level Disclosure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/segment.py:102
Finding: Documented Segment Schema Is Not Enforced Before Filesystem Paths Are Constructed
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (36)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: There is a clear description/behavior mismatch. The declared purpose says the skill is for splitting a long-form video into topical short clips and that it only cuts and crops, producing raw clips plus per-clip SRTs. This code chunk is a subtitle-processing and burn-in utility: in batch mode it reads segments.json, slices subtitles to segment boundaries, writes per-clip SRTs, and burns them into pre-existing clip MP4s; in standalone mode it burns a given SRT into a single video. The code never performs topic extraction, segmentation selection, or actual video cutting from the long-form source. Its primary function is subtitle slicing and rendering, including a downstream post-production step the description explicitly excludes.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This is a clear mismatch. The declared description is about segmenting long-form video into topical short clips and outputting raw video clips plus clip-specific SRT files. The supplied code does none of that: it does not read video, process transcripts, cut clips, or generate SRTs. Its primary purpose is image composition for cover art, using existing background/frame images and segment titles to create platform-formatted thumbnail/cover PNGs. While both may relate to a broader video workflow, this code chunk implements a materially different function from the declared skill purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This code does not implement the declared core function of splitting long-form video into topical clips or handling SRT transcript-based segmentation. Instead, its primary purpose is to create visual cover images/thumbnails/title cards for pre-existing segments using GPT image generation/editing. That is a materially different capability from 'ONLY cuts and crops' and from producing raw clips plus per-clip SRTs. The script also depends on existing segment metadata and frame images, indicating it is a downstream asset-generation step rather than the clipping operation described.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear description-behavior mismatch. The declared purpose is a segmentation utility for long-form media plus transcript SRTs, intended to split content into 3–6 topical short clips and output raw clips with per-clip SRTs. The supplied code does none of that. Its sole purpose is to prepend a 1.5-second still-image intro/cover to already existing clips, in batch or standalone mode. While it references segments.json in batch mode, that file is only used to locate preexisting clip and cover filenames; the script does not identify segments, cut video, crop video, read transcript subtitles, or emit per-clip SRTs. This is a materially different primary purpose, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The code is related to clip segmentation, so the broad domain matches, but the declared behavior is not accurately represented. The implementation depends on an existing segments.json rather than a transcript/SRT input, and its documented outputs are clip MP4s, frame JPGs, and a copied segments.json. The description specifically promises raw clips plus per-clip SRTs, which are not generated here. It also claims the skill only cuts and crops, yet the code performs no cropping and additionally extracts still frames. These are material mismatches in both inputs and outputs/capabilities.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script explicitly implements subtitle burn-in despite the skill being described as cut/crop-only and intended to hand off raw clips plus per-clip SRTs for downstream processing. This scope expansion creates an undeclared media transformation capability, increasing the chance that the agent performs irreversible content modification the user did not request or the platform did not authorize.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: In batch mode, the code re-encodes clip videos into burned outputs, directly contradicting the declared handoff-only workflow. Because burn-in is destructive and changes the media artifact itself, this creates an integrity and expectation mismatch: users or orchestrators may believe they are receiving untouched raw clips when they are not.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This script clearly performs cover-image generation, including background selection, text rendering, and image export, which exceeds the manifest’s declared scope of only cutting/cropping video into raw clips with per-clip SRTs. Scope divergence is dangerous because downstream users, orchestrators, or permission models may grant this skill access under narrower assumptions, causing unexpected asset generation and violating least-privilege expectations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script explicitly generates AI-edited covers and title-card assets, while the skill manifest says the skill only cuts/crops raw clips and outputs per-clip SRT handoff artifacts. That hidden scope expansion is dangerous because it causes the agent to perform materially different actions than advertised, including external media generation and modification of deliverables, which can bypass user expectations, reviews, and policy boundaries.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The docstring says the generated cover doubles as a title-card intro that gets prepended to the clip, which directly contradicts the manifest's claim that the skill outputs only raw clips and SRTs for downstream post-production. In agent environments, this kind of mismatch is dangerous because it can silently alter final media artifacts and expand the skill's authority beyond what operators and users believe it does.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This script performs title-card intro generation and video post-processing beyond the skill's declared scope of only cutting and cropping raw clips. Scope expansion is dangerous because it can bypass user expectations, downstream review boundaries, and least-privilege assumptions; in an agent setting, hidden extra capabilities often create opportunities for policy evasion or unauthorized content modification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest promises 'raw clips + per-clip SRTs as a hand-off package,' but this script only copies the input segments.json for traceability and never reads, slices, or emits SRT subtitle files. That is a direct mismatch between the claimed hand-off package and the implemented outputs.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill clearly directs use of shell commands, local file reads/writes, and environment-dependent tooling, but does not declare any explicit tool scope or permissions boundary. That makes it easier for an agent runtime to over-grant capabilities or execute the workflow in an unintended environment, increasing the blast radius if the skill or its dependencies are modified or abused.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Broad trigger phrases like '切片' or 'split into clips' can cause unintended activation in contexts where the user did not intend to run a shell-heavy video-processing workflow. In an agentic environment, accidental invocation can lead to unnecessary file operations, overwriting outputs, or execution of expensive local commands on the wrong media.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 69% confidence
Finding: The workflow instructs the agent to create and reuse segments.json, which introduces persistent intermediate state that may be stale, overwritten, or inadvertently reused across tasks. In multi-step agent environments, this can cause one user's segmentation metadata to affect another run or lead to processing the wrong source files if the workspace is shared or not cleaned.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
(does covers + captions + illustrations + CTA + final render)

text
## Step 1 — Read SRT, write `segments.json` **Don't outsource topic identification to a script.** For each candidate segment, judge:

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instructions require titles to use "8–12 Chinese chars per line," which enforces a specific language/locale convention in the skill's output. The file does not indicate that this is optional, user-selected, or limited to a clearly documented region-specific deployment, so it appears to force a locale-specific output format.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest and repeated documentation emphasize that this skill 'ONLY cuts and crops' in the sense of producing raw clips for downstream post-production, and specifically says 'segment.py cuts; /wjs-reframing-video reorients'. However, Step 3 embeds substantial operational guidance to create a new Python venv, install dependencies, and run another skill's crop script, effectively extending this skill into orchestrating reframing work rather than limiting itself to segmentation hand-off.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The title description says to aim for '8-12 Chinese chars per line, 2 lines max', which is a natural-language constraint favoring a specific language/locale. In this schema file there is no indication that the skill offers language choice or that the constraint is explicitly justified as region-specific, so it fits the language-policy violation category.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Standalone full-video subtitle burning is unrelated to the skill's stated purpose of extracting topical short clips from long-form content. This unauthorized extra capability broadens what the agent can do with user media and makes policy bypass or unintended processing more likely, especially in automated pipelines that trust the manifest scope.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The code adds an external subtitle-rendering execution path via ffmpeg/libass, which is outside the narrow segmentation-only scope described by the skill metadata. In context, the problem is not merely subprocess usage but the undeclared capability to transform media content, which weakens trust boundaries between manifest, reviewer expectations, and actual runtime behavior.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/burn_subs.py (reported line 116)May include surrounding context.
python
if not p or not Path(p).exists(): continue try: out = subprocess.run([p, "-filters"], capture_output=True, text=True) if "subtitles" in out.stdout: return p except OSError:

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The module docstring advertises a generic cover composer workflow that contradicts the skill description claiming the skill only outputs raw clips and per-clip SRT handoff packages. This mismatch increases the risk of misleading operators and automated systems about what the skill actually does, which can enable unintended processing paths and weaken trust and review controls.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The docstring explicitly states a Chinese typography constraint, and the prompt template later enforces 'ONE bold Chinese title' for every generated cover. This is a natural-language locale policy issue because the skill forces a specific language output rather than offering a user-selectable language or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code invokes an external AI image-generation CLI/provider even though the skill is supposed to segment existing video into clips. This adds undeclared networked/provider-side processing of user content and broadens the trust boundary, creating privacy, cost, and policy risks that are not justified by the stated purpose of the skill.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/burn_subs.py (reported line 143)May include surrounding context.
python
"--size", size, "--out", str(out_path), ] proc = subprocess.run(cmd, capture_output=True, text=True) if proc.returncode != 0: sys.stderr.write(proc.stderr[-3000:]) proc.check_returncode()

Static analysis

No suspicious patterns detected.