Clips Machine

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:08 AM UTC
• Version: 1.2.1

Overview

This video-clipping skill is purpose-aligned, but it needs Review because its output folder argument can write files outside the documented output area and its docs understate some runtime authority.

Review this before installing if you process private media or run agent-provided commands. Use only videos you are authorized to process, keep outputs in a trusted directory, avoid untrusted --output values, and install ffmpeg, yt-dlp, and whisper-cpp from trusted pinned sources where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: clips_machine.py:396

Finding

User-Controlled Output Path Can Escape the Intended Output Directory

Content

View full analysis

Remediation

View remediation

Path: base = OUTPUT_DIR.resolve() candidate_name = Path(output_name) if ( candidate_name.is_absolute() or len(candidate_name.parts) != 1 or output_name in ("", ".", "..") ): raise ValueError("Output must be a single directory name") candidate = (base / candidate_name).resolve() if not candidate.is_relative_to(base): raise ValueError("Output directory escapes the configured output root") candidate.mkdir(parents=False, exist_ok=False) return candidate ``` Replace the vulnerable construction with: ```python output_dir = safe_output_directory(output_name) ``` If compatibility with older Python versions is required, perform containment validation using `os.path.commonpath()` instead of `Path.is_relative_to()`. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:118

Finding

Unpinned Third-Party Package Installation Instruction

Content

View full analysis

Remediation

View remediation

\ --hash=sha256: ``` Install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` The version and hash must be populated from a verified release artifact and updated only after review. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The metadata and description claim the skill is self-contained and uses no external modules, yet the file explicitly requires external binaries and supports downloading from third-party URLs. That mismatch can mislead users and security controls about the real attack surface, especially because remote fetching and shelling out to external executables materially increase risk compared with a purely local, self-contained transformation skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises capabilities that imply network access, local file creation, and shell execution through ffmpeg, yt-dlp, and whisper-cpp, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a transparency and policy gap: users and the host agent may approve the skill without understanding that it can download remote content and write multiple derivative artifacts to disk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

brew install ffmpeg yt-dlp whisper-cpp

Or on Linux

sudo apt install ffmpeg pip install yt-dlp

Build whisper.cpp from source

text

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest and module docstring present the skill as 'self-contained, no external modules,' yet the implementation shells out to ffmpeg, ffprobe, yt-dlp, whisper-cpp, and which, and also downloads videos from remote platforms. That is a meaningful behavior/scope mismatch because these are substantial external runtime dependencies rather than incidental implementation details.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This is an active contradiction between the top-level documentation and the implementation. Core operations rely on subprocess calls to ffmpeg/ffprobe, yt-dlp, whisper-cpp, and which, so the code is not self-contained in the ordinary sense described by the docstring.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · clips_machine.py (reported line 72)May include surrounding context.

python

def get_video_duration(video_path: str) -> float:
    """Get video duration in seconds"""
    result = subprocess.run([
        "ffprobe", "-v", "quiet",
        "-show_entries", "format=duration",
        "-of", "default=noprint_wrappers=1:nokey=1",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · clips_machine.py (reported line 94)May include surrounding context.

python

"-o", output_path,
        url
    ]
    subprocess.run(cmd, capture_output=True, text=True, timeout=600)
    return output_path

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · clips_machine.py (reported line 101)May include surrounding context.

python

def transcribe_with_timestamps(video_path: str) -> List[Dict]:
    """Extract audio and transcribe with Whisper.cpp"""
    audio_path = secure_tempfile(suffix=".wav")
    subprocess.run([
        "ffmpeg", "-y", "-i", video_path,
        "-ar", "16000", "-ac", "1", "-c:a", "pcm_s16le",
        audio_path

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The code sets the transcription model to ggml-base.en.bin, which enforces English transcription behavior. Because the skill does not provide any user opt-in, language selection, or documented justification for this locale constraint, it conflicts with the policy against forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · clips_machine.py (reported line 113)May include surrounding context.

python

whisper_cmd = "whisper-cpp"
    whisper_model = "/usr/local/share/whisper-cpp/models/ggml-base.en.bin"

    if subprocess.run(["which", whisper_cmd], capture_output=True).returncode != 0:
        whisper_cpp_dir = Path.home() / ".whisper-cpp"
        whisper_cmd = str(whisper_cpp_dir / "main")
        whisper_model = str(whisper_cpp_dir / "models" / "ggml-base.en.bin")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · clips_machine.py (reported line 118)May include surrounding context.

python

whisper_cmd = str(whisper_cpp_dir / "main")
        whisper_model = str(whisper_cpp_dir / "models" / "ggml-base.en.bin")

    subprocess.run([
        whisper_cmd, "-m", whisper_model,
        "-f", audio_path, "-oj", "-of", output_base
    ], capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · clips_machine.py (reported line 145)May include surrounding context.

python

def cut_video(input_path: str, output_path: str, start: float, end: float) -> str:
    """Cut a segment from a video"""
    subprocess.run([
        "ffmpeg", "-y",
        "-ss", str(start),
        "-i", input_path,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · clips_machine.py (reported line 158)May include surrounding context.

python

def crop_to_vertical(input_path: str, output_path: str) -> str:
    """Crop horizontal video to vertical 9:16 (center crop)"""
    subprocess.run([
        "ffmpeg", "-y",
        "-i", input_path,
        "-vf", "crop=ih*9/16:ih",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 89% confidence

Finding

The ffmpeg ass filter argument embeds a temporary file path directly into a filter string. Because ffmpeg filter syntax treats certain characters specially, an unusual temp path or hostile environment/file-system conditions could break parsing or, in edge cases, enable filter-argument injection rather than being treated purely as a filename.

Content

Scanner excerpt · clips_machine.py (reported line 364)May include surrounding context.

python

with open(ass_file, "w") as f:
        f.write(header + events)

    subprocess.run([
        "ffmpeg", "-y", "-i", video_path,
        "-vf", f"ass={ass_file}",
        "-c:v", "libx264", "-preset", "fast", "-c:a", "aac",

Tainted flow: 'transcript_path' from os.getenv (line 422, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 87% confidence

Finding

The output path ultimately derives from OUTPUT_DIR, which is sourced from an environment variable and used for file writes without restriction. In environments where an attacker can influence env vars or invocation parameters, this can lead to arbitrary file creation/overwrite in attacker-chosen directories, especially when combined with the user-controlled output_name path component.

Content

Scanner excerpt · clips_machine.py (reported line 423)May include surrounding context.

python

print("\nStep 2/5: Transcribing audio...")
    transcript = transcribe_with_timestamps(video_path)
    transcript_path = output_dir / "transcript.json"
    with open(transcript_path, "w") as f:
        json.dump(transcript, f, indent=2)
    results["transcript"] = str(transcript_path)
    print(f"   Done - Transcribed {len(transcript)} segments")

Tainted flow: 'moments_path' from os.getenv (line 438, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 87% confidence

Finding

This write has the same path-trust issue: the destination is derived from an environment-controlled base directory and a user-influenced folder name. If abused in a shared or automated environment, the program may overwrite files outside the intended workspace.

Content

Scanner excerpt · clips_machine.py (reported line 439)May include surrounding context.

python

moments = detect_viral_moments(transcript, num_clips=num_clips, min_score=min_score)
    moments_path = output_dir / "viral_moments.json"
    with open(moments_path, "w") as f:
        json.dump(moments, f, indent=2)
    results["viral_moments"] = str(moments_path)
    print(f"   Done - Found {len(moments)} viral moments")

Tainted flow: 'output_dir' from os.getenv (line 397, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 87% confidence

Finding

Writing summary.md under output_dir is vulnerable to the same path traversal/arbitrary write class of issue. The skill context makes this more relevant because CLI tools are often run in automation where environment variables and arguments may be externally influenced.

Content

Scanner excerpt · clips_machine.py (reported line 498)May include surrounding context.

python

summary += f"- Time: {moment['start_time']:.1f}s - {moment['end_time']:.1f}s\n"
        summary += f"- Hook: {moment['hook']}\n- File: clip_{i+1:03d}.mp4\n\n"

    with open(output_dir / "summary.md", "w") as f:
        f.write(summary)
    results["summary"] = str(output_dir / "summary.md")

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill describes transcription, clipping, and export behavior but does not warn that it will generate transcripts, scored-moment metadata, and clipped media files on disk. This is a privacy and data-handling issue because derivative artifacts may contain sensitive spoken content or copyrighted material and may persist after the task is complete.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The supported sources section encourages downloading content from third-party platforms but omits a privacy and compliance warning. Users may not realize that providing URLs causes network requests to those services and may implicate platform terms, personal data, or sensitive media processing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.