clip-editor

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:11 AM UTC
• Version: 1.0.0

Overview

The skill is mainly a video-editing workflow, but it uses broad local and network authority with under-disclosed external processing and runtime package installation.

Review this skill before installing. Use it only for videos you are comfortable sending to external AI/media services, run it in an isolated environment, avoid --break-system-packages, require explicit approval before draft creation or uploads, and do not use confidential media unless the remote-service behavior is fully understood.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: scripts/build_payload.py:152

Finding

Automatic Installation of Unpinned Third-Party Packages at Runtime

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run_clip_pipeline.py:238

Finding

Model-Controlled Content Is Written to an HTML Preview Without Escaping

Content

View full analysis

' f'{i+1}') clips_list = "".join([ f'

' f'{i+1}' f'

{h.get("title","")}' f'{int(h["start"]//60)}:{int(h["start"]%60):02d} – ' f'{int(h["end"]//60)}:{int(h["end"]%60):02d} ' f'({int(h["end"]-h["start"])}s)' f'

{h.get("hook","")}

' for i, h in enumerate(highlights) ]) ``` ### Technical Analysis The `title` and `hook` fields are returned by Anthropic after processing a transcript that may contain attacker-controlled speech or text. These values are interpolated directly into HTML element content and an HTML attribute without contextual escaping. A malicious or manipulated model response can therefore terminate the intended attribute or element and inject arbitrary HTML. Script-capable markup, event-handler attributes, or navigation elements may execute or become active when the generated `timeline_preview.html` is opened in a browser. This is an indirect injection chain: untrusted media influences the transcript, the transcript influences model output, and model output is treated as trusted HTML. ### Attack Path 1. An attacker supplies or influences ...[truncated 1086 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run_clip_pipeline.py:204

Finding

Unvalidated Server-Provided Download URL Enables SSRF and Unbounded Downloads

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run_clip_pipeline.py:66

Finding

Remote Media and Transcript Disclosure Is Inconsistent With the Documented Privacy Boundary

Content

View full analysis

list: """Transcribe using the OpenAI Whisper API.""" from openai import OpenAI client = OpenAI(api_key=api_key) print(f"Calling OpenAI Whisper API: {video_path}") kwargs = {"model": "whisper-1", "response_format": "verbose_json", "timestamp_granularities": ["segment"]} if language: kwargs["language"] = language with open(video_path, "rb") as f: transcript = client.audio.transcriptions.create(file=f, **kwargs) ``` The full transcript is subsequently sent to Anthropic regardless of whether transcription was local: ```python client = anthropic.Anthropic() transcript_text = "\n".join([ f"[{seg['start']:.1f}s - {seg['end']:.1f}s] {seg['text']}" for seg in segments ]) message = client.messages.create( model="claude-sonnet-4-20250514", max_tokens=3000, messages=[{"role": "user", "content": prompt}] ) ``` The vectcut request also sends the absolute local path: ```python payload = { "video_source": video_source, "clips": clips, "template": { "style": style, "ratio": ratio, "resolution": "1080p", "caption_style": "subtitle_center", "transition": "fade", "bgm": "auto", "color_grade": "cinematic", }, "export": { "format": "jianying_draft", "include_captions": True, "auto_color_grade": True, "generate_cover": True, } } resp = requests.post("https://api.vectcut.com/v1/drafts/ ...[truncated 2712 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (61)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This mismatch specifically matters because it hides use of external services and different output behaviors than advertised, including external API dependence and different artifact generation. In a media-processing skill, undeclared third-party processing can expose user content, prompts, or metadata to outside services without clear consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch specifically matters because it hides use of external services and different output behaviors than advertised, including external API dependence and different artifact generation. In a media-processing skill, undeclared third-party processing can expose user content, prompts, or metadata to outside services without clear consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This mismatch specifically matters because it hides use of external services and different output behaviors than advertised, including external API dependence and different artifact generation. In a media-processing skill, undeclared third-party processing can expose user content, prompts, or metadata to outside services without clear consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch specifically matters because it hides use of external services and different output behaviors than advertised, including external API dependence and different artifact generation. In a media-processing skill, undeclared third-party processing can expose user content, prompts, or metadata to outside services without clear consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This mismatch specifically matters because it hides use of external services and different output behaviors than advertised, including external API dependence and different artifact generation. In a media-processing skill, undeclared third-party processing can expose user content, prompts, or metadata to outside services without clear consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This code calls Anthropic's API even though the skill metadata only declares local Whisper, Qwen-VL-Plus, and edge-tts. The hidden external model dependency causes undisclosed data transmission and expands the trust boundary, especially because prompts may include movie names, character data, and event descriptions derived from user content.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The code dynamically installs a package at runtime for a feature that is not essential to safe execution of the stated skill and does so without isolation or verification. This introduces supply-chain risk, environment tampering, and operational instability that are disproportionate to the skill's video-editing purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares no explicit tool/permission scope while its instructions require filesystem access, environment variable access, shell execution, and network use. In an agent environment, that mismatch can grant the model broad operational latitude without clear guardrails, increasing the chance of unintended file access, command execution, or data exfiltration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The invocation triggers are very broad and overlap with ordinary conversation about videos, subtitles, narration, and editing. That increases the chance the skill activates unexpectedly and gains access to shell, files, network, or local media-processing behavior in contexts where the user did not intend to invoke such a powerful workflow.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation first states that every run must produce exactly four files in the output directory: narration MP3s, subtitles.srt, clip MP4s, and draft_content.json. Later, Step 7 explicitly says a valid importable draft requires two draft files, draft_meta_info.json and draft_content.json, which makes the earlier 'exactly 4 files' contract inaccurate and contradictory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file states requirements and user prompts in Chinese and defaults the narration voice to zh-CN-XiaoxiaoNeural, while the narration prompt also mandates a specific Chinese stylistic output. There is no explicit language-choice step or opt-in allowing users to select another language or locale.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium

• Category: Output Handling
• Confidence: 89% confidence

Finding

The instruction to show all clips with no truncation, even for large inputs, can force very large model outputs and excessive token consumption. In agent settings this can create denial-of-service style failures, context flooding, cost amplification, and reduced visibility of important warnings or approval details.

Content

Scanner excerpt · SKILL.md (reported line 375)May include surrounding context.

text

**Rules for this display:**
- Show ALL clips, no truncation — even if there are 20+ clips
- Each clip box must contain: stage, source timestamp range, estimated duration, full narration text, output filenames
- Show project name WITH conflict suffix (e.g. `误判(1)`) so user sees the final name before committing
- Wait for explicit user approval before proceeding to Step 4

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/vectcut-api.md (reported line 131)May include surrounding context.

md

}
    }

    resp = requests.post(f"{api_base}/api/v1/generate", json=payload, timeout=60)
    resp.raise_for_status()
    result = resp.json()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The code automatically runs pip install at runtime with '--break-system-packages' if openai is missing. This creates a supply-chain and environment-integrity risk because execution can modify the host Python environment and fetch remote code without explicit user consent or deployment-time pinning.

Content

Scanner excerpt · scripts/build_payload.py (reported line 155)May include surrounding context.

python

from openai import OpenAI
    except ImportError:
        import subprocess, sys
        subprocess.run([sys.executable, "-m", "pip", "install", "openai",
                        "--break-system-packages", "-q"], check=True)
        from openai import OpenAI

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/build_payload.py (reported line 184)May include surrounding context.

python

def extract_frame(video_path: str, timestamp: float, output_path: str):
    """Extract a single frame from the video at `timestamp` seconds."""
    subprocess.run([
        "ffmpeg", "-y", "-ss", str(timestamp),
        "-i", video_path, "-vframes", "1",
        "-q:v", "2", output_path

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises clip analysis and CapCut draft generation, but this section also renders a final MP4. That scope expansion means the skill performs additional file-processing actions beyond its declared behavior, increasing attack surface and creating a capability mismatch that can surprise users and reviewers.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 86% confidence

Finding

The concat render path invokes ffmpeg with '-safe 0' on a generated concat file, disabling ffmpeg's path safety checks. Because clip paths flow into concat.txt and the skill handles user-supplied media workflows, this increases exposure to unsafe file references and risky ffmpeg processing of untrusted inputs.

Content

Scanner excerpt · scripts/build_payload.py (reported line 465)May include surrounding context.

python

f.write(f"file '{os.path.abspath(p)}'\n")

    output_path = os.path.join(output_dir, "output_video.mp4")
    subprocess.run([
        "ffmpeg", "-y",
        "-f", "concat", "-safe", "0", "-i", concat_path,
        "-vf", f"scale={original_width}:{original_height}"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The prompt hard-codes Chinese instructions and output requirements, including Chinese stylistic references and length measured in Chinese characters, with no option for the user to choose language or locale. This is a natural-language policy violation because it enforces a specific language without explicit opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Anthropic request sends generated prompt content to an external service without any visible user-facing disclosure or consent flow. In this skill context, the prompt may embed details extracted from uploaded video content, making the undisclosed transmission a privacy and compliance issue.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The code transmits content to https://api.anthropic.com/, creating an external data egress path not reflected in the declared skill description. Because the request is built from narration prompt content derived from user media context, this can expose sensitive or copyrighted material to a third party.

Content

Scanner excerpt · scripts/build_payload.py (reported line 537)May include surrounding context.

python

}).encode()

        req = urllib.request.Request(
            "https://api.anthropic.com/v1/messages",
            data=payload,
            headers={"Content-Type": "application/json"},
            method="POST"

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill enumerates local JianYing/CapCut draft directories to detect naming conflicts, which exceeds the minimally necessary access for clip analysis. Probing local application data reveals information about the user's installed software and project names, creating unnecessary privacy exposure and filesystem access beyond the advertised core function.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/build_payload.py (reported line 567)May include surrounding context.

python

"""
    draft_dir = next((d for d in JIANYING_DRAFT_DIRS if os.path.isdir(d)), None)
    if not draft_dir:
        return base_name  # draft dir not found, proceed without checking

    existing = set(os.listdir(draft_dir))
    if base_name not in existing:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The function performs state-changing MCP operations (create_draft, add_video, add_audio, add_text, add_subtitle, save_draft) immediately when called, while the only approval control is a comment and a separate preview helper that is never enforced. In an agent setting, this can cause unintended project creation or modification from ambiguous prompts, prompt-injection-influenced workflows, or accidental invocation without explicit user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

VOICE_DEFAULT is hard-coded to zh-CN-XiaoxiaoNeural, and the script also includes Chinese fallback/output text, which establishes a default language/locale choice. There is no visible user opt-in, locale selection flow, or documentation justifying why Chinese is mandatory for this skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Allowing the skill to install packages dynamically at runtime is broader than necessary for video editing and gives the skill the ability to fetch and execute new code on demand. In an agent setting, that materially increases risk because execution behavior can change after deployment without review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.