TikTok Clipper

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:25 PM UTC
• Version: 1.0.0

Overview

This video-clipping skill is mostly purpose-aligned, but it automatically modifies the Python environment and stores sensitive media artifacts in poorly contained local paths.

Install only if you are comfortable running it in an isolated virtual environment or container, pinning dependencies yourself, and sending the video/audio content to OpenAI for transcription. Avoid sensitive recordings unless that data flow is acceptable, and clean up generated transcripts, .ass subtitle files, clips, and temporary audio files after use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: transcribe.py:20
• Finding: Unpinned Third-Party Package Installed at Runtime<![CDATA[ ## Vulnerability Details **File Location**: `transcribe.py`, lines 20–24 **Vulnerability Type**: Uncontrolled and unpinned runtime dependency installation **Risk Level**: Medium ### Vulnerable Code ```python try: from openai import OpenAI except ImportError: subprocess.run([sys.executable, "-m", "pip", "install", "--break-system-packages", "-q", "openai"], check=True) from openai import OpenAI ``` ### Technical Analysis When the `openai` module is unavailable, the program automatically invokes `pip` to install the latest package published under that name. The installation does not specify an exact version, package hash, lockfile, or explicitly trusted package repository. This makes the code executed by the application dependent on mutable external package-index content that was not part of the audited project. The effective dependency may change between executions without any corresponding change to this repository. The use of `--break-system-packages` is particularly unsafe because it permits pip to modify a system-managed Python environment. This can replace or conflict with operating-system-managed dependencies and affect applications other than this Skill. ### Attack Path 1. An attacker compromises the configured Python package index, DNS/network path, package publisher account, or an upstream package release. 2. Alternatively, the host is configured to use a malicious or untrusted pip index through environment variables or pip configuration. 3. The Skill is executed in an environment where `openai` is not already installed. 4. The `ImportError` handler invokes pip without a pinned version or verified hash. 5. Pip downloads and installs the attacker-controlled or compromised package. 6. Package installation hooks or imported module code execute with the privileges of the user running the Skill. ### Impact Assessment Successful exploitation can result in arbitrary code execution with the privileges of the Skill process. Depend ...[truncated 507 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all automatic package installation from application runtime. 2. Declare the dependency in a reviewed dependency file and pin it to an exact version. 3. Generate a lockfile and require cryptographic hashes for downloaded distributions. 4. Install dependencies during a controlled deployment or setup phase. 5. Use an isolated virtual environment instead of `--break-system-packages`. 6. Restrict dependency installation to a trusted package repository. 7. If the dependency is missing at runtime, terminate with a clear error rather than modifying the host: ```python try: from openai import OpenAI except ImportError as exc: raise RuntimeError( "The pinned OpenAI dependency is not installed. " "Install the project's locked dependencies before running this command." ) from exc ``` 8. Perform dependency vulnerability and provenance checks as part of the build process. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: transcribe.py:68
• Finding: Predictable Shared Temporary Files Allow File Clobbering and Audio Disclosure<![CDATA[ ## Vulnerability Details **File Location**: `transcribe.py`, lines 68–77 and 121 **Vulnerability Type**: Unsafe temporary-file handling **Risk Level**: Medium ### Vulnerable Code The chunk directory and filenames are shared and predictable: ```python temp_dir = Path("/tmp/whisper_chunks") temp_dir.mkdir(exist_ok=True) all_segments = [] all_words = [] all_text = [] i = 0 while offset < duration: chunk_path = str(temp_dir / f"chunk_{i}.mp3") ``` The primary extracted-audio path is also fixed: ```python if args.audio_only: audio_path = args.input else: audio_path = "/tmp/whisper_extract.mp3" extract_audio(args.input, audio_path) ``` The extraction command forcibly overwrites its output: ```python cmd = [ "ffmpeg", "-i", video_path, "-vn", "-acodec", "libmp3lame", "-q:a", "4", "-y", audio_path ] subprocess.run(cmd, capture_output=True, check=True) ``` ### Technical Analysis The program stores sensitive extracted audio under fixed names in the globally shared `/tmp` namespace: - `/tmp/whisper_extract.mp3` - `/tmp/whisper_chunks/chunk_0.mp3` - `/tmp/whisper_chunks/chunk_1.mp3` - Additional sequential chunk names These paths are not created through secure temporary-file APIs. The code does not establish a unique directory for each invocation, verify path ownership, reject symbolic links, or explicitly apply restrictive permissions. Because `ffmpeg` is invoked with `-y`, existing output paths are overwritten. A local attacker who can write to the shared temporary namespace may pre-create a predictable path or symbolic link. Concurrent legitimate executions can also overwrite or remove one another’s audio files. The main `/tmp/whisper_extract.mp3` file is not deleted after transcription. Chunk files are removed only after successful processing, so failures or process termination can leave sensitive audio behind. ### Attack Path #### Local file-clobbering scenario 1. A local attacker predicts that the victim will us ...[truncated 1847 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a unique, private temporary directory for every invocation using `tempfile.TemporaryDirectory()`. 2. Store both the extracted audio and all chunks inside that directory. 3. Apply restrictive permissions and do not reuse predictable names across jobs. 4. Ensure cleanup occurs automatically on success, exceptions, and ordinary process termination. 5. Do not use a persistent shared directory such as `/tmp/whisper_chunks`. 6. Avoid following attacker-controlled symbolic links when creating output files. 7. Add concurrency tests to verify that parallel transcription jobs cannot access or delete one another’s files. A safer structure is: ```python import tempfile from pathlib import Path def main(): parser = argparse.ArgumentParser(description="Transcribe video/audio with Whisper") parser.add_argument("--input", "-i", required=True) parser.add_argument("--output", "-o", required=True) parser.add_argument("--audio-only", action="store_true") args = parser.parse_args() with tempfile.TemporaryDirectory(prefix="whisper-") as temp_dir: if args.audio_only: audio_path = args.input else: audio_path = str(Path(temp_dir) / "extracted.mp3") extract_audio(args.input, audio_path) result = transcribe(audio_path) with open(args.output, "w", encoding="utf-8") as f: json.dump(result, f, ensure_ascii=False, indent=2) ``` The chunking function should receive the private temporary directory as an argument and place all chunk files inside it. Cleanup should remain managed by the enclosing context rather than relying only on individual `os.remove()` calls. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The 'When to use' section lists phrases like 'clip this' and 'find viral moments', which are relatively generic and could overlap with ordinary user requests outside a narrowly defined TikTok clipping context. The file does not provide negative examples or explicit constraints describing when these phrases should not activate the skill.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs use of the OpenAI Whisper API for transcription but does not warn that audio/video content will be sent to an external service. This creates a privacy and data-handling risk, especially if users provide sensitive, private, or regulated media without informed consent.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-show_entries", "format=duration",
        "-of", "json", input_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    data = json.loads(result.stdout)
    
    width = height = 0

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-show_entries", "format=duration",
        "-of", "json", input_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    data = json.loads(result.stdout)
    
    width = height = 0

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-show_entries", "format=duration",
        "-of", "json", input_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    data = json.loads(result.stdout)
    
    width = height = 0

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if result.returncode != 0:
        # Try without escaping
        cmd[5] = f"ass={ass_path}"
        result = subprocess.run(cmd, capture_output=True, text=True)
        if result.returncode != 0:
            print(f"ffmpeg error: {result.stderr[-500:]}")
            sys.exit(1)

• Confidence: 75% confidence
• Finding: The fallback path substitutes the filter argument with raw ass_path content after the escaped form fails. Although subprocess.run still avoids shell injection, ffmpeg's filter parser will interpret the unescaped value, so specially crafted subtitle paths can break filter parsing or be interpreted unexpectedly by ffmpeg, creating a parser-injection/option-confusion risk and making processing of untrusted paths less safe.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"-vn", "-acodec", "libmp3lame", "-q:a", "4",
        "-y", audio_path
    ]
    subprocess.run(cmd, capture_output=True, check=True)
    print(f"Audio extracted: {audio_path}")

def transcribe(audio_path: str) -> dict:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        from openai import OpenAI
    except ImportError:
        subprocess.run([sys.executable, "-m", "pip", "install", "--break-system-packages", "-q", "openai"], check=True)
        from openai import OpenAI

    client = OpenAI(api_key=os.environ.get("OPENAI_API_KEY"))

• Confidence: 92% confidence
• Finding: Automatically installing a package at runtime executes code fetched from an external package repository and modifies the host environment without explicit user consent. Using pip with --break-system-packages further increases risk by bypassing normal environment protections, which can lead to supply-chain compromise or destabilization of the system if package sources are tampered with or unexpected versions are installed.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code uploads audio content to the OpenAI Whisper API but does not clearly warn the user that local media will be transmitted to an external service. In a transcription skill, this is especially relevant because recordings may contain sensitive personal, business, or regulated information, creating privacy, compliance, and data-handling risk if users assume processing is local.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: This hard-codes a specific language for transcription, which can violate language/locale policy when the user has not opted into that locale. The file contains no indication that the skill is intentionally limited to Spanish or that users can override the setting.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def transcribe_chunked(audio_path: str, client) -> dict:
    """Split audio into chunks and transcribe each."""
    # Get duration
    probe = subprocess.run(
        ["ffprobe", "-v", "quiet", "-show_entries", "format=duration", "-of", "json", audio_path],
        capture_output=True, text=True
    )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

chunk_path = str(temp_dir / f"chunk_{i}.mp3")
        end = min(offset + chunk_duration, duration)
        
        subprocess.run([
            "ffmpeg", "-i", audio_path,
            "-ss", str(offset), "-to", str(end),
            "-acodec", "libmp3lame", "-q:a", "4",

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The chunked transcription path repeats the same hard-coded Spanish locale, so users of larger files are also forced into a specific language setting without choice. This is a natural-language locale constraint that is neither user-configurable nor justified in the file.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill states that all outputs are written to a fixed local directory but does not warn the user about that storage behavior. This can expose generated clips or subtitle outputs to unintended local persistence, access by other users/processes on the host, or confusion about where sensitive media artifacts are stored.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: This code writes a new subtitle file containing transcript text derived from the user's input data. While file creation is central to the tool's purpose, there is no explicit warning in the CLI help, comments near the operation, or other user-facing disclosure that the transcript content will be persisted to disk as a separate .ass file.