Short Video Reverse Engineer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:07 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent video-analysis purpose, but its scripts include unsafe file operations, hardcoded external execution paths, and persistent environment changes that users should review before installing.

Install only in an isolated, non-admin Python environment and review the scripts first. Confirm the exact video folder, temp directory, output directory, and archive behavior before running; avoid untrusted config JSON files; and replace hardcoded external paths with package-relative paths before using batch generation.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/batch_generate_reports.py:14

Finding

Batch Generator Executes a Hardcoded External Template

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/extract_video_one_shot.py:38

Finding

Caller-Controlled Temporary Path Is Recursively Deleted Without Containment Validation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/gen_report_template.py:18

Finding

Configuration Values Permit Output Path Traversal and Stored HTML Injection

Content

View full analysis

') P('') P('') P(f'{VIDEO_BASE} - 分析报告') ``` ### Technical Analysis `VIDEO_BASE` is treated both as a filename component and as trusted HTML. A crafted value containing path separators or traversal sequences can cause generated files and directories to escape the intended `OUTPUT_DIR`. No normalized-path containment check is performed before directory creation or file writing. The same value is inserted directly into the `` element. A payload containing a closing title tag and additional markup can break out of the title context and inject active HTML or JavaScript into the generated report. Related relative image paths derived from `VIDEO_BASE` are also inserted into HTML attributes without dedicated attribute validation. The general `esc` helper exists, but it is not used for the title and ...[truncated 1374 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:217

Finding

Installation Instructions Use Unpinned Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

该代码块的实际功能是一个批量任务运行器：读取目录中的 config_*.json，并通过 subprocess 调用固定路径的 gen_report_template.py。虽然这可能是整体系统中的辅助脚本，但就当前提供的代码而言，其主要目的与声明的“短视频反向工程分析”不一致。它没有直接处理视频、音频、帧、OCR/ASR、视觉模型、合规检查，也没有展示生成报告内容的实现。因此，这属于描述与代码行为的实质性不匹配，而不仅仅是实现细节缺失。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

声明描述的是一个端到端的短视频分析与二创辅助工具，但该代码块的功能范围明显更窄，主要是媒体预处理与转写。已实现的部分只有关键帧提取、音频提取、中文语音转文字，以及生成供后续分析使用的 contact sheet 和 JSON/转录文件。声明中的多个核心输出和分析能力——尤其是逐帧视觉分析、HTML 报告、中文提示词、制作建议、合规审查、10 秒改编方案——在代码中都没有体现。因此描述显著高于实际行为，属于能力不匹配。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description states that the generated analysis report includes AI prompts '仅中文', imposing a language restriction by default. This is a natural-language policy concern because the file does not offer the user a language choice or document a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill describes shell execution, file reads/writes, environment access, and automated movement of user files, yet it declares no explicit tool scope or permission boundaries. In an agent environment this can lead to overbroad execution authority, making it easier for the skill to process unintended files, move data, or invoke local commands without clear user-visible constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation triggers are broad enough to match ordinary user requests like 'analyze this video' or 'turn this into a script,' increasing the chance the skill auto-activates without clear user intent for reverse-engineering, file scanning, or batch processing. In this skill, that matters because activation can lead to shell execution, directory scanning, report generation, and movement of local files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L231-L232 明确宣称 extract_video_one_shot.py 已“新增 msys 路径自动转换”，L242 和 L257 也再次说明路径可用 msys 或任意格式并自动转换。但 L297 又写明调用该脚本时“视频路径和 temp_dir 都必须使用 Windows 风格路径，不能使用 msys 风格”，这与前述能力描述直接冲突，属于文档/注释层面的主动矛盾。

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/batch_generate_reports.py (reported line 34)May include surrounding context.

python

for cfg_path in config_files:
        print(f"\n[Processing] {os.path.basename(cfg_path)}")
        r = subprocess.run([PYTHON, TEMPLATE, cfg_path], capture_output=True, text=True)
        if r.stdout:
            print(r.stdout)
        if r.stderr:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a skill for analyzing short videos and generating reports, but this helper script implements arbitrary subprocess execution via a hardcoded external Python binary and target script. Launching external processes is not an obvious requirement of the declared analysis capability itself and expands execution power beyond the stated purpose.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract_video_one_shot.py (reported line 49)May include surrounding context.

python

os.makedirs(frames_dir)
    cmd = [ffmpeg, "-y", "-i", video, "-vf", f"fps={fps}", "-q:v", "2",
           os.path.join(frames_dir, "frame_%04d.jpg")]
    subprocess.run(cmd, capture_output=True, timeout=120)
    frames = sorted([f for f in os.listdir(frames_dir) if f.endswith('.jpg')])
    return frames_dir, frames

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract_video_one_shot.py (reported line 58)May include surrounding context.

python

os.makedirs(frames_dir)
    cmd = [ffmpeg, "-y", "-i", video, "-vf", f"fps={fps}", "-q:v", "2",
           os.path.join(frames_dir, "frame_%04d.jpg")]
    subprocess.run(cmd, capture_output=True, timeout=120)
    frames = sorted([f for f in os.listdir(frames_dir) if f.endswith('.jpg')])
    return frames_dir, frames

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring states 'Whisper 中文转写' and the code hard-codes language='Chinese', which enforces a specific language behavior for all inputs. This is a natural-language policy violation because the skill does not offer language selection or explain why the locale restriction is required.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script copies an ffmpeg binary into a hard-coded Python environment outside the working directory, modifying host tooling as a side effect of normal execution. This is dangerous because it breaks workspace isolation, can persistently alter other workflows or users’ environments, and may replace a trusted binary with an unexpected one if the source path is influenced or compromised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The generated HTML is explicitly tagged with lang="zh-CN", and the report content and UI strings throughout the file are fixed in Chinese. This imposes a specific language/locale without offering user opt-in or documenting that the skill is intended only for a Chinese-language workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring presents the script purpose and usage entirely in Chinese, and the script does not indicate that language selection is optional or that the tool is intended only for a Chinese-speaking locale. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The docstring says '提取关键帧', which implies keyframe-based extraction, but the ffmpeg command uses a regular fps filter (fps=0.5) rather than selecting codec/GOP keyframes. This is an active documentation-to-code mismatch about what kind of visual sampling the skill performs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.