T08 · Insecure Dependencies
Warning
- Location
transcribe.py:20- Finding
Unpinned Third-Party Package Installed at Runtime
- Content
View full analysis
- Remediation
View remediation
Security audit
TikTok Clipper
Security checks for vulnerabilities and agentic risk
Overview
This video-clipping skill is mostly purpose-aligned, but it automatically modifies the Python environment and stores sensitive media artifacts in poorly contained local paths.
Install only if you are comfortable running it in an isolated virtual environment or container, pinning dependencies yourself, and sending the video/audio content to OpenAI for transcription. Avoid sensitive recordings unless that data flow is acceptable, and clean up generated transcripts, .ass subtitle files, clips, and temporary audio files after use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
transcribe.py:68- Finding
Predictable Shared Temporary Files Allow File Clobbering and Audio Disclosure
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The 'When to use' section lists phrases like 'clip this' and 'find viral moments', which are relatively generic and could overlap with ordinary user requests outside a narrowly defined TikTok clipping context. The file does not provide negative examples or explicit constraints describing when these phrases should not activate the skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructs use of the OpenAI Whisper API for transcription but does not warn that audio/video content will be sent to an external service. This creates a privacy and data-handling risk, especially if users provide sensitive, private, or regulated media without informed consent.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "-show_entries", "format=duration", "-of", "json", input_path ] result = subprocess.run(cmd, capture_output=True, text=True) data = json.loads(result.stdout) width = height = 0
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "-show_entries", "format=duration", "-of", "json", input_path ] result = subprocess.run(cmd, capture_output=True, text=True) data = json.loads(result.stdout) width = height = 0
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "-show_entries", "format=duration", "-of", "json", input_path ] result = subprocess.run(cmd, capture_output=True, text=True) data = json.loads(result.stdout) width = height = 0
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
The fallback path substitutes the filter argument with raw ass_path content after the escaped form fails. Although subprocess.run still avoids shell injection, ffmpeg's filter parser will interpret the unescaped value, so specially crafted subtitle paths can break filter parsing or be interpreted unexpectedly by ffmpeg, creating a parser-injection/option-confusion risk and making processing of untrusted paths less safe.
- Content
python if result.returncode != 0: # Try without escaping cmd[5] = f"ass={ass_path}" result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print(f"ffmpeg error: {result.stderr[-500:]}") sys.exit(1)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "-vn", "-acodec", "libmp3lame", "-q:a", "4", "-y", audio_path ] subprocess.run(cmd, capture_output=True, check=True) print(f"Audio extracted: {audio_path}") def transcribe(audio_path: str) -> dict:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 92% confidence
- Finding
Automatically installing a package at runtime executes code fetched from an external package repository and modifies the host environment without explicit user consent. Using pip with --break-system-packages further increases risk by bypassing normal environment protections, which can lead to supply-chain compromise or destabilization of the system if package sources are tampered with or unexpected versions are installed.
- Content
python try: from openai import OpenAI except ImportError: subprocess.run([sys.executable, "-m", "pip", "install", "--break-system-packages", "-q", "openai"], check=True) from openai import OpenAI client = OpenAI(api_key=os.environ.get("OPENAI_API_KEY"))
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code uploads audio content to the OpenAI Whisper API but does not clearly warn the user that local media will be transmitted to an external service. In a transcription skill, this is especially relevant because recordings may contain sensitive personal, business, or regulated information, creating privacy, compliance, and data-handling risk if users assume processing is local.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This hard-codes a specific language for transcription, which can violate language/locale policy when the user has not opted into that locale. The file contains no indication that the skill is intentionally limited to Spanish or that users can override the setting.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def transcribe_chunked(audio_path: str, client) -> dict: """Split audio into chunks and transcribe each.""" # Get duration probe = subprocess.run( ["ffprobe", "-v", "quiet", "-show_entries", "format=duration", "-of", "json", audio_path], capture_output=True, text=True )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python chunk_path = str(temp_dir / f"chunk_{i}.mp3") end = min(offset + chunk_duration, duration) subprocess.run([ "ffmpeg", "-i", audio_path, "-ss", str(offset), "-to", str(end), "-acodec", "libmp3lame", "-q:a", "4",
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The chunked transcription path repeats the same hard-coded Spanish locale, so users of larger files are also forced into a specific language setting without choice. This is a natural-language locale constraint that is neither user-configurable nor justified in the file.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill states that all outputs are written to a fixed local directory but does not warn the user about that storage behavior. This can expose generated clips or subtitle outputs to unintended local persistence, access by other users/processes on the host, or confusion about where sensitive media artifacts are stored.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This code writes a new subtitle file containing transcript text derived from the user's input data. While file creation is central to the tool's purpose, there is no explicit warning in the CLI help, comments near the operation, or other user-facing disclosure that the transcript content will be persisted to disk as a separate .ass file.
- Content