本地 Vlog 制作 / Local Vlog Production

• Outcome: Review
• Latest audit: Oct 22, 2026 · 12:59 PM UTC
• Version: 1.0.0

Overview

This well-scoped video skill needs review because its dependency settings exclude a published fix for an image-processing security flaw.

Resolve the Pillow requirement and verify a patched build before processing images received from others; the current version bound rejects the cited fix. Use trusted FFmpeg installations and inspect executable settings in transferred workspaces. Keep media indexes and transcripts private, and remember that agent viewing or optional online generation can send selected content to the configured service.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (20)

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_workspace.py (reported line 71)May include surrounding context.

python

checks = []
    logs = case / "test_logs"
    logs.mkdir()
    env = dict(os.environ, PYTHONDONTWRITEBYTECODE="1")
    def run_case(label, script, arguments, expected=0):
        result = subprocess.run([sys.executable, str(BUNDLE / "tools" / script), "--root", str(case), *arguments], capture_output=True, encoding="utf-8", errors="replace", timeout=180, env=env, cwd=case)
        filename = f"{len(checks)+1:02d}.log"

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 95% confidence

Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · tools/make_demo.py (reported line 78)May include surrounding context.

python

wav=output/'demo_audio.wav'
    with wave.open(str(wav),'wb') as out:
        out.setnchannels(1);out.setsampwidth(2);out.setframerate(sr);out.writeframes(pcm.tobytes())
    result=subprocess.run([ffmpeg,'-hide_banner','-v','error','-nostdin','-n','-i',str(wav),
        '-c:a','aac','-b:a','128k',str(output/'demo_audio.m4a')],capture_output=True)
    if result.returncode: raise RuntimeError(result.stderr.decode('utf-8','replace'))
    (output/'README.txt').write_text('全部为程序生成的测试图形和低电平合成音，不是真实照片、用户语音或配乐。\n'

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/selftest.py (reported line 46)May include surrounding context.

python

report={'status':'running','synthetic_only':True,'checks':[],
            'continuous_playback':False,'actual_listening':False,'real_source_media_used':False}
    def invoke(script,*extra):
        result=subprocess.run([sys.executable,'-X','utf8',str(relocated/script),*map(str,extra)],cwd=relocated,capture_output=True)
        if result.returncode:
            raise RuntimeError(result.stderr.decode('utf-8','replace')[-5000:]+'\n'+result.stdout.decode('utf-8','replace')[-3000:])
        return result.stdout

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/selftest.py (reported line 83)May include surrounding context.

python

assert not qa['continuous_playback'] and not qa['actual_listening']
        passed('full_render_decode_and_expected_duration',frames=240,duration_seconds=8)
        def packets(path):
            data=subprocess.check_output([fp,'-v','error','-select_streams','a:0','-show_packets','-show_data_hash','sha256',
                '-show_entries','packet=pts_time,dts_time,duration_time,data_hash','-of','json',str(path)])
            return json.loads(data)['packets']
        before=packets(relocated/'examples/media/demo_audio.m4a')

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/selftest.py (reported line 91)May include surrounding context.

python

assert before==after, 'Accepted master AAC content or timestamps changed'
        passed('aac_packet_content_and_timestamps_preserved',packet_count=len(after))
        def frame(seconds):
            data=subprocess.check_output([ff,'-v','error','-ss',str(seconds),'-i',str(relocated/video),'-frames:v','1','-f','rawvideo','-pix_fmt','rgb24','-'])
            return np.frombuffer(data,dtype=np.uint8).reshape((640,360,3))
        a,b=frame(1.5),frame(2.3)
        movement=float(np.abs(a[505:550].astype(float)-b[505:550].astype(float)).mean())

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_workspace.py (reported line 63)May include surrounding context.

python

Image.new("RGB", (120, 80), "#76b4c9").save(theme / "IMG_20260102_030405.jpg", exif=exif)
    Image.new("RGB", (80, 120), "#f4cf68").save(theme / "photo.png")
    write_text_new(theme / "clip.txt", "Synthetic companion; not real footage.\n")
    creation = subprocess.run([ffmpeg, "-hide_banner", "-v", "error", "-nostdin", "-f", "lavfi", "-i", "testsrc2=size=120x80:rate=10", "-t", "2", "-an", "-c:v", "libx264", "-pix_fmt", "yuv420p", "-n", str(theme / "clip.mp4")], capture_output=True, encoding="utf-8", errors="replace", timeout=60)
    if creation.returncode:
        raise RuntimeError("合成视频创建失败：" + creation.stderr[-2000:])
    write_text_new(case / "brief.txt", "Synthetic test only; no private material.\n")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_workspace.py (reported line 73)May include surrounding context.

python

logs.mkdir()
    env = dict(os.environ, PYTHONDONTWRITEBYTECODE="1")
    def run_case(label, script, arguments, expected=0):
        result = subprocess.run([sys.executable, str(BUNDLE / "tools" / script), "--root", str(case), *arguments], capture_output=True, encoding="utf-8", errors="replace", timeout=180, env=env, cwd=case)
        filename = f"{len(checks)+1:02d}.log"
        write_text_new(logs / filename, result.stdout + "\nSTDERR:\n" + result.stderr)
        checks.append({"name": label, "expected_exit": expected, "actual_exit": result.returncode, "passed": result.returncode == expected, "log": "test_logs/" + filename})

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tools/make_demo.py (reported line 54)May include surrounding context.

python

'-colorspace','bt709','-color_range','tv',
        '-x264-params','colorprim=bt709:transfer=bt709:colormatrix=bt709',str(output/'demo_video.mp4')]
    with (output/'demo_video.encoder.log').open('wb') as error:
        process=subprocess.Popen(command,stdin=subprocess.PIPE,stderr=error)
        try:
            small = ImageFont.truetype(str(font_path),22)
            for i in range(fps*seconds):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tools/make_demo.py (reported line 78)May include surrounding context.

python

wav=output/'demo_audio.wav'
    with wave.open(str(wav),'wb') as out:
        out.setnchannels(1);out.setsampwidth(2);out.setframerate(sr);out.writeframes(pcm.tobytes())
    result=subprocess.run([ffmpeg,'-hide_banner','-v','error','-nostdin','-n','-i',str(wav),
        '-c:a','aac','-b:a','128k',str(output/'demo_audio.m4a')],capture_output=True)
    if result.returncode: raise RuntimeError(result.stderr.decode('utf-8','replace'))
    (output/'README.txt').write_text('全部为程序生成的测试图形和低电平合成音，不是真实照片、用户语音或配乐。\n'

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tools/qa.py (reported line 11)May include surrounding context.

python

def run(args):
    return subprocess.run([str(a) for a in args],capture_output=True)


def main():

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

All calls through run omit a timeout, allowing probing, hashing, muxing, or full decoding of hostile or unusually expensive media to occupy the agent indefinitely. Captured stdout and stderr are also unbounded, and audio packet inspection can produce large JSON output, creating a memory-exhaustion path even when trusted FFmpeg binaries are used.

Content

Scanner excerpt · tools/render_timeline.py (reported line 92)May include surrounding context.

python

raise TimelineError(f"Unsupported {label} fields: {', '.join(sorted(unknown))}")


def run(command, timeout=None):
    result = subprocess.run([str(item) for item in command], stdout=subprocess.PIPE,
                            stderr=subprocess.PIPE, timeout=timeout)
    if result.returncode:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 91% confidence

Finding

Commands use argument lists without a shell, so ordinary shell injection is not present. However, find_executable accepts executable paths from workspace_config.json and environment.local.json and checks only that they identify files; an attacker-controlled workspace can select a malicious executable that runs with the agent's permissions, including through ffprobe during --validate-only.

Content

Scanner excerpt · tools/render_timeline.py (reported line 93)May include surrounding context.

python

def run(command, timeout=None):
    result = subprocess.run([str(item) for item in command], stdout=subprocess.PIPE,
                            stderr=subprocess.PIPE, timeout=timeout)
    if result.returncode:
        # Commands can contain local paths; public manifests store only a short diagnostic.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 91% confidence

Finding

The encoder invocation has structured arguments and does not expose a shell-injection sink. It nevertheless executes the ffmpeg program selected by workspace-controlled configuration, allowing a malicious project to substitute its own executable; this shares the executable-trust vulnerability affecting subprocess.run.

Content

Scanner excerpt · tools/render_timeline.py (reported line 382)May include surrounding context.

python

"-x264-params", "colorprim=bt709:transfer=bt709:colormatrix=bt709",
                       "-color_primaries", "bt709", "-color_trc", "bt709", "-colorspace", "bt709", "-color_range", "tv",
                       "-movflags", "+faststart", destination]
            encoder = subprocess.Popen([str(value) for value in command], stdin=subprocess.PIPE, stderr=log)
            for index, clip in enumerate(plan["clips"]):
                decoder = None
                with open(tempdir / f"decode-{index}.log", "wb") as decode_log:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 91% confidence

Finding

Source paths and filter parameters are constrained, and the argument-list invocation avoids shell interpretation. The decoder still inherits the workspace-controlled ffmpeg executable selection, so processing a video can launch attacker-supplied code rather than the intended decoder; source-path containment does not constrain that program's permissions.

Content

Scanner excerpt · tools/render_timeline.py (reported line 391)May include surrounding context.

python

command = [ffmpeg, "-hide_banner", "-loglevel", "error", "-ss", clip.get("source_in", 0),
                                       "-i", resolve(clip["source"]), "-map", "0:v:0", "-an", "-sn", "-dn",
                                       "-vf", video_filter(clip, plan), "-frames:v", clip["frames"], "-f", "rawvideo", "-pix_fmt", "rgb24", "pipe:1"]
                            decoder = subprocess.Popen([str(value) for value in command], stdout=subprocess.PIPE, stderr=decode_log)
                        elif clip["type"] == "image":
                            still = fit_image(load_image(resolve(clip["source"])), (width, height), clip.get("fit", "cover"),
                                              clip.get("crop_center", [0.5, 0.5]), plan["background"])

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tools/workspace.py (reported line 138)May include surrounding context.

python

def run_command(command, timeout=60):
    completed = subprocess.run(command, capture_output=True, encoding="utf-8", errors="replace", timeout=timeout)
    return completed.returncode, completed.stdout, completed.stderr

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE.txt (reported line 7)May include surrounding context.

text

Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2026-112390 (Pillow: Infinite loop in MIC n_frames when the embedded TIFF); CVE-2026-112391 (Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tr); CVE-2026-112392 (Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

OSV returned advisories for this package, but its resolved version is unknown. A package-name lookup does not establish whether the installed release is affected by those advisories.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

OSV returned advisories for this package, but its resolved version is unknown. A package-name lookup does not establish whether the installed release is affected by those advisories.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · tests/test_workspace.py (reported line 29)May include surrounding context.

python

args = parser.parse_args()
    workspace = Workspace(args.root)
    def executable(name):
        value = getattr(args, name)
        if value:
            candidate = shutil.which(value)
            if not candidate and Path(value).is_file():

Static analysis

No suspicious patterns detected.