Feishu Video Editor

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:49 PM UTC
• Version: 1.0.0

Overview

This video-editing skill appears purpose-built, but unsafe command handling could let crafted video paths or timestamps run unintended system commands.

Review before installing. Use it only in a constrained account or sandbox until the shell execution is fixed by replacing exec with execFile/spawn argument arrays and validating paths/timestamps. Treat processed videos, subtitles, and extracted audio as sensitive, confirm whether auto_upload should be disabled, and prefer pinned dependency versions or a lockfile.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: src/index.ts:239

Finding

Shell Command Injection Through Unescaped Video and Timestamp Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/index.ts:302

Finding

Predictable and Race-Prone Temporary File Creation

Content

View full analysis

{ const tempPath = path.join('/tmp', `video_editor_config_${Date.now()}.json`); fs.writeFileSync(tempPath, JSON.stringify(config, null, 2)); return tempPath; } ``` `src/video_processor.py:234-243`: ```python audio_path = tempfile.mktemp(suffix='.wav') cmd = [ 'ffmpeg', '-i', video_path, '-vn', '-acodec', 'pcm_s16le', '-ar', '16000', '-ac', '1', '-y', audio_path ] subprocess.run(cmd, capture_output=True) ``` `src/video_processor.py:336-368`: ```python temp_files = [] for i, (start, end) in enumerate(ranges): temp_path = tempfile.mktemp(suffix=f'_{i}.mp4') temp_files.append(temp_path) cmd = [ 'ffmpeg', '-i', video_path, '-ss', str(start), '-to', str(end), '-c', 'copy', # 快速复制，不重新编码 '-y', temp_path ] subprocess.run(cmd, capture_output=True) # 创建文件列表 list_file = tempfile.mktemp(suffix='.txt') with open(list_file, 'w') as f: for temp_path in temp_files: f.write(f"file '{temp_path}'\n") # 合并 cmd = [ 'ffmpeg', '-f', 'concat', '-safe', '0', '-i', list_file, '-c', 'copy', '-y', output_path ] subprocess.run(cmd, capture_output=True) # 清理临时文件 os.remove(list_file) for temp_path in temp_files: os.remove(temp_path) ``` ### Technical Analysis The TypeScript layer creates a configuration file directly under `/tmp` using only the current millisecond timestamp. The name is predictable, creation is not exclusive, and `writeFileSync` follows an existing symbolic link. The generated configuration file is also never removed. The Python layer repeatedly uses `tempfile.mktemp`. This function ...[truncated 1893 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:2

Finding

Unpinned Python Dependencies Permit Unreviewed Package Changes

Content

View full analysis

=20230314 librosa>=0.10.0 pydub>=0.25.1 pysrt>=1.1.2 numpy>=1.24.0 ``` The documented installation flow executes: ```bash pip install -r requirements.txt ``` ### Technical Analysis Every Python dependency uses an open-ended minimum-version constraint. A fresh installation can therefore resolve to package releases that did not exist when the Skill was reviewed. Transitive dependencies are also not locked, and no package hashes are supplied. This makes builds non-reproducible and expands supply-chain exposure. If a permitted future release or one of its transitive dependencies is compromised, unexpectedly vulnerable, or behaviorally incompatible, installation or import may execute code that was never reviewed with this project. No evidence was found that the currently named packages are typosquatted or intentionally malicious. The finding concerns unsafe dependency resolution rather than a confirmed malicious dependency. ### Attack Path 1. An operator follows the documented command `pip install -r requirements.txt`. 2. The package resolver selects the newest versions satisfying the `>=` constraints, along with unconstrained transitive dependencies. 3. A selected release contains malicious installation/runtime code or a newly introduced vulnerability. 4. Package installation, import, or video processing executes that code under the installing or runtime account. 5. The resulting compromise inherits the permissions and accessible resources of that account. This path depends on a compromised or unsafe package release entering the allowed dependency range. ### Impact Assessment Potential impact includes: - Arbitrary code execution during dependency installation or impo ...[truncated 405 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

bash

# Ubuntu/Debian
sudo apt update && sudo apt install -y ffmpeg

# macOS
brew install ffmpeg

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README advertises automatic video upload/download, editing, and subtitle generation but does not clearly warn users that their video content will be transferred and processed, which can expose sensitive media and embedded audio/text without informed consent. In a video-editing skill, this omission is especially important because videos often contain confidential visuals, voices, and metadata, so users may unknowingly trigger remote processing of private content.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

bash

# Ubuntu/Debian
sudo apt update && sudo apt install -y ffmpeg

# macOS
brew install ffmpeg

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

bash

# Ubuntu/Debian
sudo apt update && sudo apt install -y ffmpeg

# macOS
brew install ffmpeg

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill processes user videos locally and states that uploads are automatic by default (auto_upload: true), but the warning is only indirect and does not clearly emphasize that edited videos, subtitles, and extracted audio may be sent back to Feishu cloud. This creates a real privacy and data-governance risk because users may submit sensitive media without understanding the default exfiltration path for derived artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

User-facing descriptions, errors, help text, and command aliases are presented only in Chinese, which enforces a specific language experience without offering a user choice. The file does not document a justified locale restriction or provide multilingual/opt-in behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill builds a shell command string with user-influenced values such as videoPath and extraArgs, then executes it via child_process.exec. Because exec invokes a shell, specially crafted input can trigger command injection and arbitrary OS command execution, which is especially dangerous in a video-processing skill that expects file paths from users.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/video_processor.py (reported line 116)May include surrounding context.

python

'-y', output_path
        ]
        
        result = subprocess.run(cmd, capture_output=True, text=True)
        
        if result.returncode != 0:
            return {

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/video_processor.py (reported line 216)May include surrounding context.

python

'-y', output_path
        ]
        
        result = subprocess.run(cmd, capture_output=True, text=True)
        
        if result.returncode != 0:
            return {

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/video_processor.py (reported line 379)May include surrounding context.

python

'-y', output_path
        ]
        
        result = subprocess.run(cmd, capture_output=True, text=True)
        
        if result.returncode != 0:
            return {

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The subtitle generation API sets language: str = 'zh' and maps that default to 'chinese' during transcription, which imposes a specific language choice by default. This is a natural-language locale policy concern because the user is not offered an explicit language/locale choice before the skill assumes Chinese.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

This helper creates a temporary filename with tempfile.mktemp and then asks ffmpeg to write to that path later, introducing a TOCTOU race on the filesystem. A local attacker could pre-create or replace the predictable temp path with a symlink or file, causing overwrite of unintended files or disruption of processing under the privileges of this program.

Content

Scanner excerpt · src/video_processor.py (reported line 243)May include surrounding context.

python

'-y', audio_path
        ]
        
        subprocess.run(cmd, capture_output=True)
        return audio_path
    
    def _detect_silence(self, audio_path: str) -> list:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/video_processor.py (reported line 330)May include surrounding context.

python

'-y', output_path
        ]
        
        subprocess.run(cmd, capture_output=True)
    
    def _concat_video_clips(self, video_path: str, output_path: str,
                           ranges: list) -> None:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · src/video_processor.py (reported line 363)May include surrounding context.

python

'-y', output_path
        ]
        
        subprocess.run(cmd, capture_output=True)
    
    def _concat_video_clips(self, video_path: str, output_path: str,
                           ranges: list) -> None:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 89% confidence

Finding

This invocation writes to a path produced by tempfile.mktemp, which is insecure because the filename is generated without atomically creating the file. An attacker with local filesystem access could race to create or symlink that path before ffmpeg writes to it, potentially leading to overwriting arbitrary files or corrupting workflow output.

Content

Scanner excerpt · src/video_processor.py (reported line 348)May include surrounding context.

python

'-c', 'copy',  # 快速复制，不重新编码
                '-y', temp_path
            ]
            subprocess.run(cmd, capture_output=True)
        
        # 创建文件列表
        list_file = tempfile.mktemp(suffix='.txt')

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json

"author": "Spark",
  "license": "MIT",
  "devDependencies": {
    "@types/node": "^20.0.0",
    "typescript": "^5.0.0"
  },
  "dependencies": {}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 16)May include surrounding context.

json

"license": "MIT",
  "devDependencies": {
    "@types/node": "^20.0.0",
    "typescript": "^5.0.0"
  },
  "dependencies": {}
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens reproducibility and can expose consumers to newly introduced vulnerable or breaking releases through the supply chain, even though the file itself does not directly contain exploitable code.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

# Python 依赖（视频处理）
openai-whisper>=20230314
librosa>=0.10.0
pydub>=0.25.1
pysrt>=1.1.2

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Using an unpinned version for librosa means installations are not deterministic and may pull in unexpected upstream changes or vulnerable releases. In a requirements manifest, this is a real supply-chain hygiene weakness rather than an immediate runtime exploit.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

# Python 依赖（视频处理）
openai-whisper>=20230314
librosa>=0.10.0
pydub>=0.25.1
pysrt>=1.1.2
numpy>=1.24.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The pydub dependency is not pinned to a specific release, so the environment may resolve to different versions across installs. This increases supply-chain risk and makes it harder to verify whether deployed versions contain known vulnerabilities or incompatible changes.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# Python 依赖（视频处理）
openai-whisper>=20230314
librosa>=0.10.0
pydub>=0.25.1
pysrt>=1.1.2
numpy>=1.24.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The pysrt package is declared with only a minimum version, which permits uncontrolled upgrades during installation. That creates a genuine but low-severity dependency management weakness because vulnerable or malicious upstream versions could be selected later.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

openai-whisper>=20230314
librosa>=0.10.0
pydub>=0.25.1
pysrt>=1.1.2
numpy>=1.24.0

# 飞书 SDK（可选，如果用 Python 调用）

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

NumPy is unpinned, so consumers cannot know which exact release will be installed. Because NumPy has had multiple advisories historically, leaving the version open-ended makes risk assessment and patch verification difficult and can expose deployments to vulnerable versions.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

librosa>=0.10.0
pydub>=0.25.1
pysrt>=1.1.2
numpy>=1.24.0

# 飞书 SDK（可选，如果用 Python 调用）
# lark-oapi>=1.0.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The manifest references numpy without pinning an exact version, while known advisories exist for some NumPy releases. Because the actual installed version is unverifiable from this file, consumers may unknowingly install an affected release, making this a real supply-chain and patch-management concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The description is written only in Chinese ("AI 视频剪辑 Skill - MVP 版本"), which may impose a language expectation without offering any user choice or documenting a locale-specific purpose. Under the policy rule for language/locale, this can be a natural-language policy concern when no opt-in or justification is provided in the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

saveConfigTemp writes a JSON config file into /tmp for each operation, which modifies the local filesystem. This file contains no user-facing disclosure in help text or operation messages that temporary files are created as part of processing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.