Security audit

SRT Proofreader

Security checks for vulnerabilities and agentic risk

Overview

This SRT proofreading skill is local and purpose-aligned, though it can create a git baseline and overwrite the target subtitle as part of normal use.

Install only if you are comfortable with the skill modifying files under srts/, creating a local git repository and baseline commit when needed, and overwriting the selected SRT after proofreading. Keep unrelated or sensitive files out of srts/ and review git diff before accepting the result.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
- split into `section-001.srt`, `section-002.srt`, ... using `scripts/srt_sections.mjs`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
- split into `section-001.srt`, `section-002.srt`, ... using `scripts/srt_sections.mjs`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.
md
- split into `section-001.srt`, `section-002.srt`, ... using `scripts/srt_sections.mjs`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
- split into `section-001.srt`, `section-002.srt`, ... using `scripts/srt_sections.mjs`

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to run git init, stage all files, and create a commit automatically when no repository exists, without requiring explicit user consent. This changes the workspace state and records all current contents, which can unexpectedly capture unrelated or sensitive files and violates the principle of minimizing side effects for a proofreading task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The large-file workflow directs splitting subtitle content into generated section files and then merging them back by overwriting the original .srt, again without an explicit warning or confirmation step. Although this is framed as operational convenience, it creates avoidable file-modification risk, especially if the split/merge script is wrong, absent, or behaves unexpectedly, potentially leading to data loss or corruption.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The merge path can alter subtitle content by stripping ending punctuation from the last subtitle text line when the manifest indicates the original lacked punctuation. That exceeds a split/merge helper's expected preservation role and creates silent content mutation, which is risky in a proofreading workflow where output fidelity matters and users expect only deliberate edits.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instruction mandates replying with 还没有创建 source.md if source.md is missing, which imposes a specific language on the user. There is no opt-in, locale selection, or documented regional requirement to justify this language constraint.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The success message presents punctuation removal as if it were a benign restoration step, but the code performs an unconditional content edit whenever the manifest flag is false. This can mislead users reviewing logs, reducing detectability of unintended text modification in a tool whose purpose is supposed to preserve subtitle structure during section merge.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.