Universal Video Analyzer Zh

• Outcome: Pass
• Latest audit: May 28, 2026 · 2:44 PM UTC
• Version: 1.1.0

Overview

This skill is a disclosed video-analysis tool that sends selected video frames and transcripts to a configured AI provider and saves reports locally.

Install only if you are comfortable sending video frames and transcribed speech to the AI provider configured by VIDEO_ANALYZER_BASE_URL. Avoid sensitive or regulated videos unless you trust that provider or use a private endpoint, keep the API key private, and prefer pinned dependency versions or a lockfile for safer installs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill invokes Python, installs dependencies, uses environment variables, writes report files, and sends extracted video frames/transcripts to external model APIs, but it does not declare corresponding permissions. This creates a transparency and consent problem: a user or platform may not realize the skill has network, shell, and file-write capabilities, which increases the risk of unexpected data exfiltration or broader execution than intended.

Description-Behavior Mismatch

Low

• Confidence: 91% confidence
• Finding: The skill persists extracted frames, full transcript text, and an HTML report to disk even though the description emphasizes report generation without clearly disclosing these additional retained artifacts. This increases local data exposure risk, especially for sensitive videos, because visual content and speech may remain accessible after analysis.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README promotes sending videos directly in WeChat for automatic analysis, but does not warn users that video frames and extracted audio/transcripts will likely be transmitted to third-party model APIs. In this skill context, that omission is materially risky because users may submit sensitive personal, business, or regulated content under the assumption processing is local.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The README instructs users to place API keys in environment variables and .env files but does not warn them to keep credentials private or avoid committing .env files to source control. This increases the chance of accidental credential exposure, especially because the repository explicitly encourages creating a local .env file in the skill directory.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script sends extracted video frames and the transcribed audio content to an external multimodal API, which may contain sensitive personal, business, or regulated data. Because there is no explicit user-facing privacy warning or consent gate in the workflow, users may unknowingly transmit confidential media off-host to a third party.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Python >= 3.8 推荐

# 核心依赖
requests>=2.31.0
openai-whisper>=20231106
torch>=2.0.0

• Confidence: 88% confidence
• Finding: Using a lower-bounded version like requests>=2.31.0 allows future unreviewed releases to be installed, which can introduce breaking changes or newly disclosed vulnerable versions into deployments. In an agent skill that processes external inputs and may run across varied environments, non-reproducible dependency resolution increases supply-chain and stability risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 核心依赖
requests>=2.31.0
openai-whisper>=20231106
torch>=2.0.0

# 可选依赖（支持 .env 文件）

• Confidence: 81% confidence
• Finding: An open-ended dependency constraint for openai-whisper permits installation of unvetted future versions, reducing build reproducibility and potentially pulling in insecure or incompatible code. This is a supply-chain hardening issue rather than an immediate exploit in the file itself.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 核心依赖
requests>=2.31.0
openai-whisper>=20231106
torch>=2.0.0

# 可选依赖（支持 .env 文件）
python-dotenv>=1.0.0

• Confidence: 92% confidence
• Finding: Using torch>=2.0.0 is riskier than a typical unpinned dependency because PyTorch has had serious security issues, including unsafe deserialization and code-execution-adjacent flaws in some workflows. Allowing any later version without review increases exposure in a skill likely to handle untrusted media and model-related data.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

torch>=2.0.0

# 可选依赖（支持 .env 文件）
python-dotenv>=1.0.0

# 优化依赖（API 重试、图像处理）
tenacity>=8.2.3

• Confidence: 80% confidence
• Finding: python-dotenv>=1.0.0 allows uncontrolled future versions, which weakens reproducibility and could introduce vulnerable behavior through dependency drift. The security impact is lower than for core parsing or ML libraries, but it still represents avoidable supply-chain risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

python-dotenv>=1.0.0

# 优化依赖（API 重试、图像处理）
tenacity>=8.2.3
Pillow>=10.0.1

# 开发依赖（可选）

• Confidence: 79% confidence
• Finding: An unpinned tenacity dependency introduces non-deterministic installs and potential future dependency-based breakage or vulnerability exposure. While tenacity itself is not especially sensitive here, this still weakens supply-chain hygiene.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 优化依赖（API 重试、图像处理）
tenacity>=8.2.3
Pillow>=10.0.1

# 开发依赖（可选）
# pytest>=7.4.0

• Confidence: 90% confidence
• Finding: Pillow processes image data, which often comes from untrusted sources in multimodal/video workflows, so allowing any future Pillow version without review increases risk of pulling in parser-related vulnerabilities. In this skill context, image handling makes this more security-relevant than a generic utility package.

Known Vulnerable Dependency: torch — 10 advisory(ies): CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +7 more

Critical

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: The dependency specification torch>=2.0.0 can resolve to versions within a broad vulnerable range, and PyTorch has had severe issues including unsafe loading and code execution risks. Given this skill's likely handling of untrusted media and possibly model artifacts, a vulnerable torch version could enable denial of service or, in unsafe loading scenarios elsewhere in the project, remote code execution.

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: Pillow is an image-parsing library with a history of serious vulnerabilities, and this skill explicitly performs multimodal/video analysis where image/frame processing is central. Because the dependency is specified as Pillow>=10.0.1, vulnerable releases may still be selected, making parser bugs more dangerous in this specific workload that may process untrusted content.

Static analysis

No suspicious patterns detected.