ClawHub
Back to skill

Security audit

cutmv Video Tool

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local FFmpeg video tool, but it needs review because one metadata path can evaluate untrusted-looking ffprobe output as Python code and the tool overwrites outputs by default.

Install only if you are comfortable with a local FFmpeg wrapper that reads and writes chosen media paths. Avoid running the info command on untrusted media until the eval() frame-rate parsing is replaced with safe numeric parsing, and choose output paths carefully because existing files can be overwritten.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
skill.py:319
Finding

Unsafe Evaluation of Media Metadata May Enable Arbitrary Python Code Execution

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (14)

eval() call detected

High
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

Using eval on ffprobe output is dangerous because it executes arbitrary Python expressions, not just numeric frame-rate math. If an attacker can influence the parsed metadata or the ffprobe output source, this can lead to arbitrary code execution in the context of the running process.

Content

Scanner excerpt · skill.py (reported line 319)May include surrounding context.

python
"codec": video_stream.get("codec_name") if video_stream else None,
                "width": video_stream.get("width") if video_stream else None,
                "height": video_stream.get("height") if video_stream else None,
                "fps": eval(video_stream.get("r_frame_rate", "0/1")) if video_stream else None,
            } if video_stream else None,
            "audio": {
                "codec": audio_stream.get("codec_name") if audio_stream else None,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The document forces a specific language/locale for user-facing instructions, and the file does not indicate any user opt-in, alternative language option, or region-specific requirement. This matches the policy-violation criterion for language or locale constraints imposed without choice or justification.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README-CN.md (reported line 32)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt install ffmpeg

Windows:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt install ffmpeg

Windows:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · skill.py (reported line 28)May include surrounding context.

python
def _check_ffmpeg(self):
        """Check if ffmpeg is installed."""
        try:
            subprocess.run(
                ["ffmpeg", "-version"],
                stdout=subprocess.PIPE,
                stderr=subprocess.PIPE,

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
raise RuntimeError(
                "FFmpeg not found. Please install FFmpeg first:\n"
                "  macOS: brew install ffmpeg\n"
                "  Ubuntu: sudo apt install ffmpeg\n"
                "  Windows: winget install ffmpeg"
            )

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.py (reported line 38)May include surrounding context.

python
raise RuntimeError(
                "FFmpeg not found. Please install FFmpeg first:\n"
                "  macOS: brew install ffmpeg\n"
                "  Ubuntu: sudo apt install ffmpeg\n"
                "  Windows: winget install ffmpeg"
            )

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The helper unconditionally prepends FFmpeg's -y flag, causing existing output files to be overwritten in all video-processing operations. Although the code has internal docstrings, there is no user-facing confirmation prompt or visible warning in CLI help/output that these commands will replace files on disk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · skill.py (reported line 45)May include surrounding context.

python
def _run_ffmpeg(self, args):
        """Run ffmpeg command."""
        cmd = ["ffmpeg", "-y"] + args
        result = subprocess.run(
            cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · skill.py (reported line 232)May include surrounding context.

python
"-of", "default=noprint_wrappers=1:nokey=1",
            input_file
        ]
        result = subprocess.run(
            probe_cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · skill.py (reported line 286)May include surrounding context.

python
"-of", "default=noprint_wrappers=1:nokey=1",
            input_file
        ]
        result = subprocess.run(
            probe_cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file documents multiple operations that create or modify user files, including cutting, converting, compressing, and frame extraction, but it does not warn users that output paths will be written to disk and may overwrite existing files or consume storage. Under the markdown-specific missing-warning criterion, user-facing documentation should disclose behaviors that affect user data or system state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The extract_frames flow automatically creates the output directory and then writes a sequence of image files into it. While this behavior is part of the feature, the code provides no user-facing disclosure that it will create directories and generate potentially large numbers of files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The comment at L505 says the code will convert SRT subtitles to ASS for better compatibility, and L506 creates an ass_file path, but no conversion step ever occurs and ass_file is never used. The actual behavior is to pass the original subtitle file directly to FFmpeg's subtitles filter.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
skill.py:319