Audio Video

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:46 PM UTC
• Version: 0.1.4

Overview

The skill is a coherent FFmpeg helper, but it includes under-scoped screen/audio/webcam capture, remote streaming, continuous recording, and unverified elevated install guidance that users should review before installing.

Install only if you are comfortable reviewing FFmpeg commands before running them. Prefer package-manager FFmpeg installs, avoid unverified static binaries and mutable Docker images, confirm any camera, microphone, screen, or streaming command with explicit device, duration, output path, and destination, and test batch operations on a small sample with separate output files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:48

Finding

Unverified Third-Party FFmpeg Binary Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48–54
Vulnerability Type: Unverified third-party binary installation
Risk Level: Medium

bash

sudo apt update && sudo apt install -y ffmpeg

# Or for latest static build:
wget https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz
tar xf ffmpeg-release-amd64-static.tar.xz
FFDIR=$(find . -maxdepth 1 -type d -name 'ffmpeg-*-static' | head -n1)
sudo mv "$FFDIR/ffmpeg" "$FFDIR/ffprobe" /usr/local/bin/

Technical Analysis

The alternative installation procedure downloads a precompiled archive from a third-party distribution host and installs its executables into the system-wide /usr/local/bin directory. It does not pin a release version or verify a cryptographic signature or published checksum before extraction and installation.

HTTPS protects the download while in transit, but it does not independently verify the provenance or integrity of the artifact if the hosting account, distribution server, release pipeline, or archive itself is compromised. The floating release URL also allows the downloaded content to change after the Skill has been reviewed.

The broad find expression selects the first matching extracted directory rather than validating a precise, expected archive layout. Although this is secondary to the missing artifact verification, exact path and file validation would further reduce the risk of installing unintended files.

Attack Path

1. An attacker compromises the third-party distribution host, its release process, or the archive served by the floating release URL.
2. The user follows the documented static-build installation alternative.
3. wget downloads the substituted archive without an expected digest or signature being checked.
4. tar extracts the attacker-controlled content.
5. The shell selects a matching extracted directory and sudo mv places the supplied ffmpeg and ffprobe executables in /usr/local/bin.
6. Subsequent m ...[truncated 945 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer FFmpeg packages maintained and signed by the operating system's package repository.
2. If a static third-party build is necessary, pin an exact immutable version instead of using a floating release URL.
3. Obtain the expected SHA-256 or stronger digest through an independently authenticated channel and verify it before extraction:

   bash

   echo "EXPECTED_SHA256  ffmpeg-release-amd64-static.tar.xz" | sha256sum --check -
   

4. Where available, verify a detached cryptographic signature against a trusted, prevalidated maintainer key.
5. Abort installation immediately if checksum or signature verification fails.
6. Extract into a newly created restricted temporary directory and validate the archive member paths before extraction to prevent path traversal or unexpected file placement.
7. Validate that the selected files are regular executable files with the expected names and ownership. Avoid selecting an installation directory through an ambiguous find ... | head -n1 expression.
8. Inspect the installed version and build metadata after installation, then retain the verified digest and version in deployment records.
9. Use administrative privileges only for the final, verified copy operation. Do not process an unverified archive with elevated privileges.
10. Consider installing into a versioned, non-system directory first and exposing it through an explicitly managed path after verification.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

Linux (Ubuntu/Debian)

bash

sudo apt update && sudo apt install -y ffmpeg

# Or for latest static build:
wget https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

Linux (Ubuntu/Debian)

bash

sudo apt update && sudo apt install -y ffmpeg

# Or for latest static build:
wget https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

Linux (Ubuntu/Debian)

bash

sudo apt update && sudo apt install -y ffmpeg

# Or for latest static build:
wget https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

Linux (Ubuntu/Debian)

bash

sudo apt update && sudo apt install -y ffmpeg

# Or for latest static build:
wget https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Linux (Ubuntu/Debian)

bash

sudo apt update && sudo apt install -y ffmpeg

# Or for latest static build:
wget https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Linux (Ubuntu/Debian)

bash

sudo apt update && sudo apt install -y ffmpeg

# Or for latest static build:
wget https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 1041)May include surrounding context.

Linux (Ubuntu/Debian)

bash

sudo apt update && sudo apt install -y ffmpeg

# Or for latest static build:
wget https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill introduces capture-related functionality without an explicit privacy and consent warning near the relevant instructions. That omission increases the chance an agent or user will run recording commands without understanding they may collect screen, webcam, or microphone data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The Docker example uses jrottenberg/ffmpeg:latest, which is mutable and can change over time without review. If the upstream image is compromised or updated incompatibly, users may pull and execute unexpected code with access to the mounted working directory.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The Windows Docker example also references jrottenberg/ffmpeg:latest, creating the same mutable-supply-chain risk. Because the container mounts the host working directory, a malicious or compromised image could read or alter user files in that directory.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The streaming guidance enables transmission of media to remote RTMP/SRT endpoints, which goes beyond local media processing into data exfiltration/network publishing. In an agent setting, this is more dangerous because it can send local or captured media off-host with a single command.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The live streaming examples do not clearly warn that they send media to remote services and may expose embedded credentials such as stream keys. In practice, this can cause accidental disclosure of local or captured content to third parties.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This section extends the skill from passive file processing into active screen, webcam, and audio capture. That materially increases surveillance and privacy risk, especially if invoked by an agent without explicit per-use consent and scope confirmation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 949)May include surrounding context.

md

**If not available:** Install a full-featured ffmpeg build.
- macOS: `brew install ffmpeg-full` or `brew install ffmpeg --with-libvidstab`
- Linux: `sudo apt install ffmpeg` (Ubuntu 20.04+ includes libvidstab)
- Windows: Download from https://www.gyan.dev/ffmpeg/builds/ (full build includes libvidstab)

### Pass 1 — Detect motion (analyze shakiness)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The rolling DVR section normalizes continuous recording of screen/audio but lacks a clear warning about persistent capture and retention behavior. This creates elevated privacy risk because users may not realize the commands maintain an always-on recording buffer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The streaming section describes HLS, DASH, and RTMP delivery to remote platforms but omits a clear warning that media may be transmitted to external endpoints or third-party services. In practice, that can cause users to send private or unpublished media off-host without fully appreciating the disclosure, retention, and credential risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This section advertises screen and webcam capture with audio across platforms but does not clearly warn that commands may access local cameras, microphones, and screen contents. In an agent setting, that omission can normalize collection of sensitive local data and lead users to authorize recording without understanding the privacy implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The batch processing section encourages unattended loops, parallel jobs, and directory-wide conversions without warning about bulk modification, overwrite, or accidental processing of large media sets. In an automation context, a small mistake in paths, globs, or output settings can rapidly damage or replace many files before the user notices.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/ffmpeg-flags.md (reported line 7)May include surrounding context.

md

| Flag | Values | Description |
|------|--------|-------------|
| `-y` | — | Overwrite output without asking |
| `-n` | — | Never overwrite (skip if exists) |
| `-loglevel` | `quiet`, `error`, `warning`, `info`, `verbose`, `debug` | Log verbosity (default: `info`) |
| `-v` | same as loglevel | Alias for `-loglevel` |

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

Docker (any platform)

bash

# macOS / Linux
docker run --rm -v "$(pwd):/work" -w /work jrottenberg/ffmpeg:latest \
  -i input.mp4 output.mp4

# Windows PowerShell

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

-i input.mp4 output.mp4

Windows PowerShell

docker run --rm -v "${PWD}:/work" -w /work jrottenberg/ffmpeg:latest ` -i input.mp4 output.mp4

text

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file documents the -y flag as 'Overwrite output without asking' but provides no warning that using it can silently replace existing files. Because markdown files should warn about behaviors that can affect user data or system integrity, this omission is a relevant missing-warning issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.