Video-Watch

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:26 PM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but its frame-extraction script has unsafe argument and output-file handling that could expose or overwrite local files in some scenarios.

Install only if you are comfortable running a local shell script over videos and writing extracted frames to disk. Use trusted video paths, keep the default fps numeric, choose a private output directory, and avoid running this in shared or attacker-writable folders until the script validates fps and avoids forced overwrites.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract_frames.sh:53
• Finding: Unvalidated FPS Argument Allows FFmpeg Filtergraph Injection## Vulnerability Details **File Location**: `scripts/extract_frames.sh`, lines 7 and 53 **Vulnerability Type**: FFmpeg filtergraph expression injection **Risk Level**: Medium ### Vulnerable Code ```bash FPS="${3:-1}" ``` ```bash ffmpeg -i "$VIDEO_PATH" -vf "fps=$FPS" "$OUTPUT_DIR/frame_%03d.jpg" -y -loglevel warning ``` ### Technical Analysis The third command-line argument is documented as a numeric frame rate, but the script performs no type, range, or syntax validation before interpolating it into the FFmpeg `-vf` filtergraph. Shell quoting prevents ordinary shell metacharacters from being evaluated by Bash, but it does not make the value safe for FFmpeg's filtergraph parser. An attacker-controlled value can include FFmpeg filter separators and options. For example, a value structurally similar to: ```text 1,drawtext=textfile=/path/to/readable/file ``` can append a second video filter. Where the relevant FFmpeg filter is available, this can cause FFmpeg to read local file content and render it into generated frames. Other available filters may provide additional unintended file or resource access. ### Attack Path 1. An attacker obtains control over, or persuades a user or agent to supply, the optional `fps` argument. 2. The attacker supplies a crafted FFmpeg filter expression instead of a numeric frame rate. 3. The script concatenates the value into `-vf "fps=$FPS"` without validation. 4. FFmpeg parses the injected syntax as additional filtergraph operations. 5. The injected filter accesses a local resource readable by the script's user and places resulting information into the output frames. 6. The attacker obtains the generated frames or causes them to be processed by a downstream agent. ### Impact Assessment Exploitation occurs with the permissions of the user running the script. It does not directly grant elevated operating-system privileges, but it can exceed the documented capability of sel ...[truncated 403 chars]
• Remediation: ## Remediation Suggestions Treat the FPS value as a numeric parameter rather than an FFmpeg expression. 1. Validate the argument against a strict decimal-number allowlist. 2. Reject zero, negative, non-finite, and excessively large values. 3. Apply a reasonable upper bound to prevent resource exhaustion. 4. Do not allow commas, colons, semicolons, brackets, backslashes, or filter names. 5. Exit before invoking FFmpeg when validation fails. Example hardening: ```bash FPS="${3:-1}" if [[ ! "$FPS" =~ ^([0-9]+)([.][0-9]+)?$ ]]; then echo "Error: fps must be a positive numeric value" >&2 exit 1 fi if ! awk -v fps="$FPS" 'BEGIN { exit !(fps > 0 && fps <= 60) }'; then echo "Error: fps must be greater than 0 and no greater than 60" >&2 exit 1 fi ``` The final implementation should also be tested with malformed values to verify that no FFmpeg filtergraph syntax is accepted.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/extract_frames.sh:34
• Finding: Predictable Output Files and Forced Overwrite Permit Symlink-Based File Clobbering## Vulnerability Details **File Location**: `scripts/extract_frames.sh`, lines 34–39 and 53 **Vulnerability Type**: Unsafe predictable output path and symbolic-link file overwrite **Risk Level**: Medium ### Vulnerable Code ```bash # Set output directory if [ -z "$OUTPUT_DIR" ]; then OUTPUT_DIR="./frames_${VIDEO_NAME}" fi # Create output directory mkdir -p "$OUTPUT_DIR" ``` ```bash ffmpeg -i "$VIDEO_PATH" -vf "fps=$FPS" "$OUTPUT_DIR/frame_%03d.jpg" -y -loglevel warning ``` ### Technical Analysis The default output directory and generated filenames are predictable. The script reuses an existing directory without checking its ownership, permissions, or symbolic-link status. FFmpeg is also invoked with `-y`, which automatically overwrites existing output files. In a shared or attacker-writable working directory, an attacker can prepare the expected output directory and create symbolic links such as `frame_001.jpg` that point to another file writable by the victim. When a more privileged user runs the script, FFmpeg may follow the link and overwrite the target with JPEG output. This issue is a file-clobbering vulnerability rather than an unrestricted write primitive: the overwritten content is generated image data, and the target must be writable by the user executing the script. Nevertheless, it can destroy or corrupt files that the attacker could not modify directly. ### Attack Path 1. The victim runs the script from a directory writable by an attacker, or supplies an attacker-controlled output directory. 2. The attacker predicts the default path from the video filename, such as `frames_video`. 3. Before execution, the attacker creates that directory and places a symbolic link at an expected frame path, such as `frame_001.jpg`. 4. The symbolic link points to a file writable by the victim but not directly writable by the attacker. 5. The victim invokes the frame-extraction script. 6. `mkdir -p` accept ...[truncated 906 chars]
• Remediation: ## Remediation Suggestions 1. Create default output directories atomically with `mktemp -d` and restrictive permissions. 2. Refuse to use an existing default output directory. 3. Validate explicitly supplied output directories for ownership, permissions, and symbolic links. 4. Reject output frame paths that already exist or are symbolic links. 5. Remove FFmpeg's `-y` option by default. Require an explicit overwrite flag if replacement is intended. 6. Set a restrictive `umask`, such as `077`, before creating directories and files. 7. Prefer a trusted base directory that is not writable by other users. Example default-directory hardening: ```bash umask 077 if [ -z "$OUTPUT_DIR" ]; then OUTPUT_DIR=$(mktemp -d "./frames_${VIDEO_NAME}.XXXXXX") || { echo "Error: unable to create a private output directory" >&2 exit 1 } else if [ -L "$OUTPUT_DIR" ]; then echo "Error: output directory must not be a symbolic link" >&2 exit 1 fi mkdir -p -- "$OUTPUT_DIR" fi ``` Before invoking FFmpeg, the implementation should also verify that no expected frame destination already exists and should avoid automatic overwrite behavior.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Ubuntu/Debian
sudo apt-get install -y ffmpeg

# macOS
brew install ffmpeg

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Check if ffmpeg is installed
if ! command -v ffmpeg &> /dev/null; then
    echo "Error: ffmpeg is not installed"
    echo "Install with: sudo apt-get install -y ffmpeg"
    exit 1
fi

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.