movie-subtitler

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:46 AM UTC
• Version: 1.0.2

Overview

This skill is a straightforward local video subtitling script with expected downloads, local file creation, and media-processing dependencies disclosed.

Install dependencies from trusted sources, prefer a virtual environment for WhisperX, avoid unnecessary privileged installs, and only subtitle media you have rights and disk space to process. URL inputs will be downloaded locally and outputs are written to the current or chosen output directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:29, SKILL.md:35-37, and SKILL.md:100
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:29:

bash

pip install -U yt-dlp

SKILL.md:35-37:

bash

pip install whisperx

bash

uv pip install whisperx

SKILL.md:100:

bash

pip install -U yt-dlp

Technical Analysis

The documented installation procedure instructs users to install the latest available versions of yt-dlp and whisperx without version constraints, integrity hashes, or a dependency lockfile. The -U option explicitly permits replacement with the latest available release.

Python package installation can execute package-controlled build or installation logic. Because the requested package versions and transitive dependency versions are mutable, the code installed by a user may differ from the code reviewed during this audit. This creates a supply-chain trust gap: an upstream account compromise, malicious release, dependency confusion event, or compromised transitive dependency could introduce executable code into the installation process.

No evidence establishes that the currently published packages are malicious. The confirmed issue is that the project does not provide reproducible or integrity-verified dependency resolution.

Attack Path

1. An attacker compromises an upstream package, one of its transitive dependencies, or its package-publishing credentials.
2. The attacker publishes a malicious version that satisfies the unrestricted installation command.
3. A user follows the project documentation and runs pip install, pip install -U, or uv pip install.
4. The package manager retrieves the mutable malicious release because no reviewed version or hash is enforced.
5. Package-controlled installation or runtime code executes with the privileges of the user performing ...[truncated 752 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin all direct dependencies to reviewed, exact versions, for example whisperx==X.Y.Z and yt-dlp==YYYY.MM.DD.
2. Generate and publish a lockfile that includes resolved transitive dependencies.
3. Record cryptographic hashes and install with hash verification, such as pip install --require-hashes -r requirements.txt.
4. Avoid recommending unrestricted upgrade commands in the normal installation workflow.
5. Use an explicitly trusted package index and disable unintended supplemental indexes where practical.
6. Review dependency updates before changing pins, including release provenance, maintainership changes, and transitive dependency differences.
7. Recommend installation in an isolated virtual environment under a non-privileged account.
8. Add automated dependency scanning and reproducibility checks to the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states the skill returns videos with English subtitles, and later reiterates that English is the only translation target. This is a natural-language locale/language policy issue because the skill imposes a specific output language rather than presenting it as a user-selected option or clearly framing it as a justified region-specific tool.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

name: movie-subtitler
description: >-
  Download a foreign-language movie/video (or take a local file), transcribe and translate it to
  English with WhisperX, and recreate the video with English subtitles. Use on requests like
  "get English subs for this", "translate this movie", "subtitle this YouTube film". Fully local:
  yt-dlp → WhisperX → ffmpeg.
metadata:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md

- **ffmpeg** — audio extraction and video mux/burn.
  - macOS: `brew install ffmpeg`
  - Linux: `sudo apt install ffmpeg` (Debian/Ubuntu) or your distro's package manager
- **yt-dlp** — only needed if `--input` is a URL rather than a local file.
  - macOS: `brew install yt-dlp`
  - Linux: `pip install -U yt-dlp` or `sudo apt install yt-dlp`

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

• Linux: sudo apt install ffmpeg (Debian/Ubuntu) or your distro's package manager
• yt-dlp — only needed if --input is a URL rather than a local file.
  • macOS: brew install yt-dlp
  • Linux: pip install -U yt-dlp or sudo apt install yt-dlp
• whisperx — the transcribe/translate engine, on both macOS and Linux. Install it into a Python virtualenv, e.g.:

  bash

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This markdown file describes that --input may be a URL and that output files are written to the current directory, but it does not explicitly warn users that the skill will download remote media and create local files as a side effect. For a skill that fetches external content and writes generated outputs, a brief user-facing warning would improve disclosure of data and system-impacting behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.