Video To Article

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:52 AM UTC
• Version: 0.1.5

Overview

The skill is mostly coherent for video-to-notes workflows, but it includes unsafe script and Git examples that can execute unintended shell code or publish unrelated files.

Review before installing. Use it only in a sandboxed course workspace, inspect `_batch_screenshots.sh` carefully before running it, avoid untrusted course archives with unusual filenames, do not store cookies in notes or repositories, and replace the Git example with explicit `git status`, scoped `git add -- <generated paths>`, a staged diff review, then a separate commit and push confirmation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/plan-screenshots.py:94

Finding

Shell Command Injection Through an Unescaped Video Filename

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:251

Finding

Overbroad Git Staging Can Commit Unrelated Sensitive Files

Content

View full analysis

" && git add -A && git commit -m "video note: " && git push ``` ### Technical Analysis The example stages changes using `git add -A`, which includes every modified, deleted, and untracked file throughout the Vault repository. It is not restricted to the notes, screenshots, index entries, or logs produced by the Skill. As a result, authorizing version control for the generated output can also place unrelated files into Git history. These files may include private notes, temporary exports, credentials, authentication artifacts, or changes made by other applications. The surrounding documentation mitigates the risk by requiring explicit authorization for commits and separate confirmation for `git push`. Nevertheless, the command itself does not give the user a scoped staging operation or a mandatory review between staging, committing, and pushing. Because the example chains all three operations, a user who executes it as written has no built-in opportunity to inspect the staged contents before the commit and push occur. ### Attack Path 1. The Vault contains unrelated modified or untracked files, potentially including sensitive information. 2. The Skill generates a video note and associated assets. 3. The user authorizes versioning or executes the documented command to save the generated result. 4. `git add -A` stages every repository change rather than only Skill-generated artifacts. 5. The commit records the unrelated files in repository history. 6. If the separately required push is approved or the chained example is run as written, the commit is transmitted to the configured Git remote. 7. Anyone with access to that remote may obtain the unintentionally committed information. ### Impact Assessment The primary impact is unintended disclosure and d ...[truncated 555 chars]

Remediation

View remediation

" \ "" \ "" \ "" ``` Additional hardening should include: 1. Run `git status --short` before staging and display the result to the user. 2. Keep staging, commit, and push as separate commands rather than chaining them. 3. After staging, display `git diff --cached --stat` and `git diff --cached`. 4. Require confirmation of the exact staged file list before committing. 5. Continue requiring a separate confirmation before pushing. 6. Maintain an appropriate `.gitignore` for cookies, tokens, temporary exports, transcripts, caches, and generated batch files. 7. Use `git add -- ` so path-like values cannot be interpreted as command options. 8. If sensitive material is accidentally committed, rotate affected credentials and remove the material from repository history before pushing. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明描述的是一个较完整的“视频/字幕/课程目录 -> 结构化图文笔记”工作流，重点在生成文章、笔记、写入 Obsidian 或批量导入课程内容。而实际代码仅执行截图规划：遍历课程目录、定位 mp4、调用 ffprobe 读取时长、计算截图时间戳、生成 JSON 计划和 ffmpeg 批处理命令。它没有处理字幕、没有生成结构化笔记或文章、没有写入 Obsidian，也没有实现课程导入流程。虽然截图可能是更大工作流的辅助步骤，但就该代码块本身而言，其主要行为与声明的核心用途存在明显偏差。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

声明描述的是一个较完整的“视频/课程转结构化笔记或文章”工作流，包含较高层次的内容转换与导入能力，并强调仅在用户明确要求完整工作流时使用。而实际代码只是一个非常具体的预处理脚本：在本地课程目录中查找字幕文件，删除序号和时间戳，按 section 合并后输出纯文本文件。这属于工作流中的一个辅助步骤，但其实际主功能明显比声明窄得多，也没有实现声明中的核心产物（结构化图文笔记/文章）和关键操作（下载视频、写入 Obsidian、批量导入课程）。因此描述不能准确代表该代码块的实际行为，构成明显不匹配。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example child-agent context explicitly says '用英文写课程笔记。' ('Write course notes in English'), which imposes a language choice. The policy allows locale/language constraints only when the user is offered a choice or when the constraint is clearly documented and justified; neither is present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow explicitly instructs running a generated shell script and later committing results, but it does not require an explicit user confirmation or present safety checks around file-system changes. In an agent setting, generated scripts and automated commits can turn untrusted or incorrectly derived inputs into real system modifications, making unintended execution and persistence more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The instruction "Write the course note in English" imposes a specific language requirement in natural language. The file does not present this as user-selectable or explain that the workflow is intentionally English-only for a documented regional or compliance reason.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly recommends cookie-based login for Bilibili but provides no warning that cookies are sensitive authentication material equivalent to a logged-in session. In an agent workflow, users may be prompted to export or share cookies without understanding the account-takeover and privacy risks if those cookies are stored, logged, or exfiltrated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template instruction explicitly says "Write the course note in English," which imposes a specific language choice. Under the policy, language constraints should not be forced unless the skill offers user choice or clearly documents a justified locale restriction.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/plan-screenshots.py (reported line 69)May include surrounding context.

python

"default=noprint_wrappers=1:nokey=1",
        video_path,
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    return float(result.stdout.strip())

def slugify(name):

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The guidance suggests switching network routes or using a proxy to bypass region restrictions, but omits any warning about privacy, legal/policy, and traffic interception risks. In a skill that may be followed operationally by an agent or user, this can normalize sending video URLs and session-linked traffic through third-party infrastructure without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.