Video Content Analyzer

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:05 PM UTC
• Version: 0.1.0

Overview

This skill is a coherent video-analysis helper, but users should be careful with its broad shell access, external transcription API use, and unsafe dependency install example.

Install dependencies in a virtual environment or with pipx instead of using `--break-system-packages`, review yt-dlp/ffmpeg commands before running them, and only submit videos whose audio/transcript you are comfortable sending to OpenAI Whisper for transcription.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:62

Finding

Unpinned Dependency Installation Bypasses System Package Protections

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:62
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

bash

# Install yt-dlp (video download)
pip3 install --break-system-packages yt-dlp

Technical Analysis

The documented setup command installs the latest available yt-dlp release without pinning a reviewed version or verifying an integrity hash. Package resolution is therefore mutable: running the same command at different times may install different code from the configured Python package index.

The --break-system-packages option also disables the protection applied to externally managed Python environments. This allows pip to alter packages associated with the host's system-managed Python installation, increasing the potential for dependency conflicts and damage to applications that share that environment.

Exploitation depends on compromise or manipulation of the package supply chain, such as a compromised upstream release, package-index account, index configuration, or network/package mirror. There is no evidence in the audited file that yt-dlp itself is malicious; the finding concerns the unsafe installation procedure.

Attack Path

1. An attacker compromises a future yt-dlp release or a package source used by the environment.
2. An operator follows the documented command.
3. pip resolves the mutable latest release without checking a pinned version or expected hash.
4. Package-controlled installation or runtime code executes with the permissions of the user running pip.
5. Because system-package protection was explicitly bypassed, the installation may also modify or conflict with the system-managed Python environment.

Impact Assessment

A successful supply-chain compromise could execute arbitrary code with the installing user's privileges. It could access data and credentials available to that user, alter use ...[truncated 278 chars]

Remediation

View remediation

Remediation Suggestions

• Remove --break-system-packages.
• Install the dependency in an isolated virtual environment or through pipx.
• Pin yt-dlp to a specifically reviewed version rather than installing the mutable latest release.
• Use hash verification through a locked requirements file, for example pip install --require-hashes -r requirements.txt.
• Review and deliberately update the pinned version on a controlled schedule.
• Run dependency installation and video processing as an unprivileged user in a constrained environment.
• Prefer a trusted internal package mirror with provenance, integrity, and release-approval controls where available.

A hardened installation pattern is:

bash

python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.txt

The requirements file should contain an approved exact version and its expected distribution hashes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest restricts languages to zh, which imposes a specific language/locale constraint. There is no indication that users can opt into this limitation or that the constraint is justified as a region-specific tool, so it appears to violate the language/locale policy.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

安装 ffmpeg (音频处理)

Mac: brew install ffmpeg

Ubuntu: sudo apt install ffmpeg

text

### API Key

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill sends user-provided audio/video-derived content to the external OpenAI Whisper API, but the user-facing description and workflow do not clearly warn that third-party processing occurs or that potentially sensitive spoken content may leave the local environment. This creates a real privacy and consent risk, especially for proprietary, personal, or regulated media.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.