Ae1
High
- Category
- analysis-evasion
- Content
- split into `section-001.srt`, `section-002.srt`, ... using `scripts/srt_sections.mjs`
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
SRT Proofreader
Security checks for vulnerabilities and agentic risk
Overview
This SRT proofreading skill is local and purpose-aligned, though it can create a git baseline and overwrite the target subtitle as part of normal use.
Install only if you are comfortable with the skill modifying files under srts/, creating a local git repository and baseline commit when needed, and overwriting the selected SRT after proofreading. Keep unrelated or sensitive files out of srts/ and review git diff before accepting the result.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Ae1
High
- Category
- analysis-evasion
- Content
- split into `section-001.srt`, `section-002.srt`, ... using `scripts/srt_sections.mjs`
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
- split into `section-001.srt`, `section-002.srt`, ... using `scripts/srt_sections.mjs`
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
- split into `section-001.srt`, `section-002.srt`, ... using `scripts/srt_sections.mjs`
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Missing User Warnings
Medium
- Confidence
- 96% confidence
- Finding
- The skill instructs the agent to run `git init`, stage all files, and create a commit automatically when no repository exists, without requiring explicit user consent. This changes the workspace state and records all current contents, which can unexpectedly capture unrelated or sensitive files and violates the principle of minimizing side effects for a proofreading task.
Missing User Warnings
Medium
- Confidence
- 91% confidence
- Finding
- The large-file workflow directs splitting subtitle content into generated section files and then merging them back by overwriting the original `.srt`, again without an explicit warning or confirmation step. Although this is framed as operational convenience, it creates avoidable file-modification risk, especially if the split/merge script is wrong, absent, or behaves unexpectedly, potentially leading to data loss or corruption.
Description-Behavior Mismatch
Medium
- Confidence
- 97% confidence
- Finding
- The merge path can alter subtitle content by stripping ending punctuation from the last subtitle text line when the manifest indicates the original lacked punctuation. That exceeds a split/merge helper's expected preservation role and creates silent content mutation, which is risky in a proofreading workflow where output fidelity matters and users expect only deliberate edits.
Natural-Language Policy Violations
Low
- Confidence
- 98% confidence
- Finding
- The instruction mandates replying with `还没有创建 source.md` if `source.md` is missing, which imposes a specific language on the user. There is no opt-in, locale selection, or documented regional requirement to justify this language constraint.
Intent-Code Divergence
Low
- Confidence
- 88% confidence
- Finding
- The success message presents punctuation removal as if it were a benign restoration step, but the code performs an unconditional content edit whenever the manifest flag is false. This can mislead users reviewing logs, reducing detectability of unintended text modification in a tool whose purpose is supposed to preserve subtitle structure during section merge.
Static analysis
No suspicious patterns detected.