Wjs Syncing Multicam

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 0.1.0

Overview

This skill aligns media files by reading user-provided recordings and writing sync metadata sidecars, with no evidence of credential access, network use, persistence, destructive behavior, or hidden exfiltration.

Install only if you are comfortable letting the skill read the media files you choose, run local ffmpeg/ffprobe on them, and create or update .sync.json files beside those recordings. The documentation has one stale contradictory line about _synced.MOV output, but the inspected scripts do not generate re-encoded video files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The documentation promises sidecar-only behavior but explicitly admits the current implementation still emits `_synced.MOV` files. That mismatch is dangerous because users and orchestrators may approve the skill under a non-destructive mental model while it actually performs large write operations and re-encoding, creating integrity, storage, and privacy exposure on local media.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill describes behaviors that imply file read, file write, and shell execution, but it declares no explicit tool scope or permission boundaries. In an agent environment, that increases the chance the skill can be invoked with broader-than-necessary capabilities, enabling unintended filesystem access or command execution beyond the user's expectation.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The file repeatedly states that originals are never modified or re-encoded, yet elsewhere says the script still produces synced media files. Contradictory operational claims are a security-relevant issue because they undermine informed consent and can cause downstream automation to trust the skill with assumptions about non-destructive behavior that are false.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-map", "0:a:0", "-ac", "1", "-ar", str(SR),
        "-f", "s16le", str(dst),
    ]
    subprocess.run(cmd, check=True, stderr=subprocess.DEVNULL)


def envelope(x: np.ndarray, sr: int = SR, hop_ms: int = 10, win_ms: int = ENV_WIN_MS):

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-map", "0:a:0", "-ac", "1", "-ar", str(SR),
        "-f", "s16le", str(dst),
    ]
    subprocess.run(cmd, check=True, stderr=subprocess.DEVNULL)


def envelope(x: np.ndarray, sr: int = SR, hop_ms: int = 10, win_ms: int = ENV_WIN_MS):

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def media_duration(path: Path) -> float:
    out = subprocess.run(
        ["ffprobe", "-v", "error", "-show_entries", "format=duration",
         "-of", "default=nw=1:nk=1", str(path)],
        check=True, capture_output=True, text=True,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def extract(video, dst):
    subprocess.run(["ffmpeg", "-nostdin", "-y", "-i", str(video),
                    "-map", "0:a:0", "-ac", "1", "-ar", str(SR),
                    "-f", "s16le", str(dst)], check=True, stderr=subprocess.DEVNULL)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def media_dur(p):
    out = subprocess.run(["ffprobe", "-v", "error", "-show_entries", "format=duration",
                          "-of", "default=nw=1:nk=1", str(p)], check=True,
                         capture_output=True, text=True)
    return float(out.stdout.strip())

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The skill emphasizes that originals are untouched, but it does not clearly foreground that `.sync.json` files are written beside every input and later updated during verification. In security terms this is a transparency and surprise-write issue: users may run the skill in sensitive directories without realizing metadata files will be created or modified there.

Static analysis

No suspicious patterns detected.