Caption track preflight

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:58 PM UTC
• Version: 1.0.0

Overview

This skill is a bounded caption-file preflight workflow that uses a disclosed PowMCP checker, with install and data-sharing caveats users should understand.

Before installing, confirm you trust PowMCP and the skill source, preferably use a pinned or reviewed revision if available, and remember that caption files or public URLs submitted to the MCP service may be processed remotely. Do not provide credentialed or private URLs unless you intend to share that caption content with the service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40
• Finding: Unpinned Third-Party Installer and Skill Source<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:40` **Vulnerability Type**: Unpinned third-party dependencies and mutable installation sources **Risk Level**: Medium ### Vulnerable Code ```markdown npx skills add powmcp/skills --skill preflight-caption-track-before-client-handoff ``` ### Technical Analysis The documented installation command invokes the third-party `skills` package through `npx` without specifying an exact package version. It also identifies `powmcp/skills` without pinning the installed Skill to a reviewed commit or immutable release. Consequently, the components retrieved when a user runs this command may differ from those reviewed during this audit. If the npm package, its dependency chain, its publishing account, or the referenced Skill repository is compromised or subsequently modified, the command could retrieve and run or install attacker-controlled content. This issue is limited to users who execute the documented installation command. The audited project itself contains no embedded executable scripts, and the audit found no evidence that installation is performed automatically. ### Attack Path 1. An attacker compromises the unpinned npm package, one of its dependencies, its publishing credentials, or the mutable upstream Skill source. 2. The attacker publishes a malicious package version or modifies the content retrieved from the upstream Skill repository. 3. A user follows `SKILL.md:40` and executes the documented `npx skills add` command. 4. `npx` resolves the mutable package version available at execution time, while the installer resolves Skill content that is not tied to the audited revision. 5. Malicious installer code may run with the invoking user's privileges, or altered Skill instructions may be installed and later loaded by the agent. ### Impact Assessment Successful exploitation could execute commands with the privileges of the user running `npx`, access files and environment variables available to ...[truncated 359 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the `skills` npm package to an exact reviewed version, rather than allowing `npx` to resolve the latest available release. 2. Pin `powmcp/skills` to an immutable commit hash or cryptographically signed release supported by the installer. 3. Publish expected package integrity hashes or signatures and verify them before installation. 4. Use a lockfile where applicable and enable package-manager integrity and provenance verification. 5. Avoid instructing users to install directly from mutable default branches. 6. Document that installation should occur under a non-privileged account and in a sandboxed environment. 7. Re-audit the exact pinned installer and Skill revision whenever either dependency is updated. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The skill instructs users to install and run an MCP-related package via `npx skills add powmcp/skills` without any version pinning or integrity control. That creates a supply-chain risk: a future compromised, typosquatted, or maliciously updated package/version could be executed in the user's environment when they follow the skill.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

Use the actual WebVTT, SRT, or TTML/IMSC file intended for handoff, not a draft or reconstruction.

Provide one attached file or one public HTTP(S) URL. Do not provide both. Do not ask the user to host an attached file publicly.

Record the attachment identity or public URL. Do not repeat a URL query string in narration.

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.