Security audit

video-translation

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with video dubbing, but it relies on unpinned third-party executable skills, cloud TTS handling of source media, and optional plaintext API-key storage.

Review and pin the external downloader and TTS dependencies before installing, avoid storing NOIZ_API_KEY in a repo .env file, and only use this on videos whose voice and contents may be processed by the referenced TTS backend. Prefer extracting minimal reference audio clips and running the workflow in a restricted working directory.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:85
Finding: Unpinned Third-Party Skill Code Is Installed and Executed
Content: View full analysis
-o /tmp/video-translation ``` ```bash bash skills/tts/scripts/tts.sh render --srt translated.srt --voice-map voice_map.json --backend noiz --auto-emotion --ref-audio-track original_video.mp4 -o dubbed.wav ``` ### Technical Analysis The installation instructions direct users to clone or copy executable Python and shell code from mutable branches of two external GitHub repositories. They do not specify a reviewed commit hash, immutable release, checksum, signature, or mandatory source review. Consequently, the effective code executed by the Skill can change after this package has been audited. Repository ownership or GitHub hosting does not provide integrity guarantees against account compromise, malicious upstream changes, or dependency takeover. This ...[truncated 1545 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:37
Finding: Complete Source Video and Voice Data Are Delegated to External TTS Code
Content: View full analysis
" } } ``` Render the timeline-accurate audio: ```bash bash skills/tts/scripts/tts.sh render --srt translated.srt --voice-map voice_map.json --backend noiz --auto-emotion --ref-audio-track original_video.mp4 -o dubbed.wav ``` ``` The external backend credential is also required: ```markdown - `NOIZ_API_KEY` configured for the Noiz backend. If it is not set, first guide the user to get an API key from `https://developers.noiz.ai/api-keys`. After the user provides the key, ask whether they want to persist it; if they agree, either write/update `NOIZ_API_KEY=...` in the project's `.env` file or run `bash skills/tts/scripts/tts.sh config --set-api-key YOUR_KEY` to store it. ``` ### Technical Analysis The workflow passes the complete original video to separately installed TTS code while selecting the external Noiz backend. Voice recordings may constitute sensitive or biometric data. The stated purpose only requires reference audio corresponding to subtitle intervals, but the third-party component receives a path to the complete video and is trusted to perform the slicing. This grants ...[truncated 2047 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description claims an end-to-end video translation and dubbing function: translating from one language to another and replacing original audio with TTS. However, the provided code only accepts an existing video file and an existing audio file, then uses ffmpeg to either replace the original audio track or mix dubbed audio with the original audio using SRT-based ducking intervals. There is no code for language detection, translation, subtitle translation, speech synthesis, or voice generation. The only matching part is that the video stream is kept intact while audio is swapped or mixed. Because the core advertised capabilities of translation and TTS are absent, this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The code does not implement translation, dubbing, TTS, or video/audio replacement. Its actual function is narrowly focused on parsing SRT timestamps and producing volume control commands, likely to mute original audio during subtitle segments. While this could be a supporting component in a larger dubbing pipeline, on its own it materially differs from the declared primary purpose and omits the core advertised capabilities.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill performs file reads and writes, downloads media, and generates outputs, but it does not declare any explicit tool scope or permissions. This weakens least-privilege controls and makes it harder for a host agent to constrain filesystem actions, increasing the chance of unintended file access or overwrite during execution.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
md
- **Dependencies (other skills)** - **youtube-downloader** ([crazynomad/skills](https://github.com/crazynomad/skills)) — [SKILL.md](https://github.com/crazynomad/skills/blob/master/youtube-downloader/SKILL.md) Install: clone or copy the `skills/youtube-downloader` directory from [crazynomad/skills](https://github.com/crazynomad/skills) into your `skills/` folder so that `skills/youtube-downloader/scripts/download_video.py` is available. - **tts** ([NoizAI/skills](https://github.com/NoizAI/skills)) — [SKILL.md](https://github.com/NoizAI/skills/blob/main/skills/tts/SKILL.md) If not already in this repo: clone or copy the `skills/tts` directory from [NoizAI/skills](https://github.com/NoizAI/skills) into your `skills/` folder. Ensure `skills/tts/scripts/tts.sh` and related scripts are present. - `NOIZ_API_KEY` configured for the Noiz backend. If it is not set, first guide the user to get an API key from `https://developers.noiz.ai/api-keys`. After the user provides the key, ask whether they want to persist it; if they agree, either write/update `NOIZ_API_KEY=...` in the project's `.env` file or run `bash skills/tts/scripts/tts.sh config --set-api-key YOUR_KEY` to store it. - `ffmpeg` installed.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs the agent to persist an API key into a project .env file or tool config, creating a credential-handling path inside a workflow whose main purpose is media translation. Storing secrets in repo-local files can expose credentials through source control, backups, logs, or later agent reads, especially in multi-skill environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Persisting an API key to .env or tool config without a prominent warning is a real credential-safety issue because users may not understand the long-term storage and exposure implications. In an agent setting, stored credentials can later be accessed by unrelated tasks, leaked via repository sync, or exposed through file inspection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This markdown skill instructs the agent to download a video and subtitles, then save translated subtitles to a new file, but it does not explicitly warn the user that local files will be created under /tmp/video-translation and as translated.srt. For markdown files, SQP-2 applies when the description omits warnings about behaviors that could affect user data or system state.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.