Video Analyzer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:48 PM UTC
• Version: 1.0.1

Overview

This video skill mostly does what it claims, but its bundled script has a real command-injection flaw that could let a crafted language argument run arbitrary shell commands.

Review before installing. The skill is not judged malicious, but it should be fixed to remove shell=True, pass subprocess arguments as arrays, and validate language codes. Until then, do not use it with untrusted prompts or unusual --lang values, and expect it to contact video platforms, write temporary transcripts, optionally save media to Desktop, and download Whisper models on first use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/analyze_video.py:184

Finding

Arbitrary Command Execution via Unsanitized Language Argument

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description frames the capability as analysis/transcription, but the instructions also authorize direct media downloads to the Desktop and imply possible model/network fetches that are not clearly disclosed. This mismatch can mislead users and orchestrators about the real side effects, causing unexpected file creation, network access, and broader operational exposure than the declared purpose suggests.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md

### Multilingual Support
All Whisper models are **multilingual by default**. The skill can transcribe videos in any language (Italian, Spanish, Japanese, etc.).

**IMPORTANT:** Always respond to the user in THEIR language, not the video's language. If the user speaks Italian but sends an English video, give them the summary in Italian. 

### Finding specific moments
The transcript includes **precise timestamps** like `[05:53] text...`. If the user asks "When do they talk about X?", grep the transcript and return the exact timestamp from the file.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This is a true tool-parameter-abuse issue because the script builds shell commands from externally influenced parameters and executes them through shell=True. In the skill context, the user is expected to provide arbitrary video URLs and language codes, which makes the injection surface directly reachable and especially dangerous for remote command execution on the agent host.

Content

Scanner excerpt · scripts/analyze_video.py (reported line 43)May include surrounding context.

python

def run_cmd(cmd, check=True):
    """Run a shell command and return stdout."""
    try:
        result = subprocess.run(cmd, shell=True, check=check, capture_output=True, text=True)
        return result.stdout
    except subprocess.CalledProcessError as e:
        if check:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README overstates privacy and cost guarantees by saying the workflow is '100% free and private' while the skill necessarily contacts third-party platforms to retrieve media and may auto-download Whisper models. This can mislead users about network exposure, metadata leakage, and first-run downloads, which is a documentation security issue even if the core processing is local.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill instructs the agent to use shell commands, read generated transcript files, and download media to disk, but it declares no explicit tool scope or permissions. This creates an authorization gap where the agent may exercise filesystem and shell capabilities without transparent constraints, increasing the chance of unintended command execution or file access beyond the user’s expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance is broad enough to trigger on many ordinary video-related prompts, including simple requests to know 'what's in' a shared URL. Overbroad invocation increases the likelihood that the agent will fetch remote content, run shell commands, or create local artifacts without a sufficiently specific user request or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs downloading video/audio files to the Desktop without warning the user that local files will be created. Silent file creation on a user-visible location can lead to privacy issues, storage abuse, or surprising side effects, especially if the agent is triggered automatically from a URL-sharing request.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/analyze_video.py (reported line 26)May include surrounding context.

python

"""Verify all required binaries are installed."""
    missing = []
    for bin_name in REQUIRED_BINS:
        result = subprocess.run(
            ["which", bin_name], capture_output=True, text=True
        )
        if result.returncode != 0:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

The helper executes arbitrary shell command strings with shell=True, and multiple callers interpolate user-controlled values such as url and lang into those strings. The custom quote_url function only attempts to escape single quotes and does not provide robust shell safety for all parameters, so an attacker may be able to inject shell metacharacters and execute arbitrary commands on the host.

Content

Scanner excerpt · scripts/analyze_video.py (reported line 43)May include surrounding context.

python

def run_cmd(cmd, check=True):
    """Run a shell command and return stdout."""
    try:
        result = subprocess.run(cmd, shell=True, check=check, capture_output=True, text=True)
        return result.stdout
    except subprocess.CalledProcessError as e:
        if check:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code creates temporary files for downloaded media and transcripts, and later downloads a Whisper model from a remote URL if it is missing. While there are status messages, they do not clearly warn users up front that content will be fetched from external services and stored locally, which is relevant to privacy and disk-usage expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest frames the skill as downloading videos in service of local transcription and analysis, emphasizing TL;DRs, timestamps, and understanding video content. This code also exposes standalone download-video and download-audio actions that save media files to the user's Desktop, which is a broader end-user file acquisition capability rather than an obvious implementation detail of analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

For code files, safety-relevant file writes should have some user disclosure unless they are clearly and explicitly communicated. Although the function name implies downloading, the code writes user-visible files to the Desktop and only prints a progress message, not a clear warning or confirmation about where files will be saved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file advertises a capability to "Save any video as MP4 or extract the audio as MP3/M4A," which implies writing files to the user's system. The README does not include any warning or disclosure about local file creation, overwrite/location considerations, or storage impact, despite SQP-2 applying to markdown descriptions of data-affecting behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The docstring for download_model_if_needed specifically claims it will download the Whisper model to a 'Homebrew share dir'. The implementation hardcodes /opt/homebrew/share/whisper-cpp, which is not a general Homebrew share path on all systems and may not match the documented intent outside that environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.