Video Pipeline Bundle

• Analyzed: May 11, 2026, 4:54 AM
• Findings: 1
• Version: 1.0.2
• Hash: 0ed6462d57fbc9401c09475eb92bddeb7affb2f2594dbc9b46466c5861c9b564
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious primarily due to multiple shell injection vulnerabilities found in `scripts/pipeline.py`. This script constructs commands using f-strings with user-controlled input paths (e.g., `input_dir`, `output_dir`, `output_file`) and then executes them via `subprocess.run(cmd, shell=True, ...)`. This allows an attacker to inject arbitrary shell commands by crafting malicious directory or file names, leading to potential Remote Code Execution (RCE). Additionally, `scripts/video_clip.py` and `scripts/video_to_text.py` use `pip install --break-system-packages`, which is a risky practice that can interfere with system Python environments, although this is transparently documented in `SKILL.md`.