clip-editor

• Outcome: Review
• Latest audit: May 28, 2026 · 1:25 PM UTC
• Version: 1.0.0

Overview

The skill is a real video-editing workflow, but it needs review because it can alter the host Python environment and send video-derived data to multiple cloud services.

Review before installing. Use an isolated virtual environment or container, preinstall pinned dependencies instead of allowing runtime pip installs, and run it only on videos, transcripts, frames, and narration text you are comfortable sending to configured providers such as Anthropic, OpenAI, Qwen/DashScope, edge-tts, vectcut, or CapCut MCP. Require explicit confirmation before cloud processing, package installation, downloads, or saving drafts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (31)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

f.write(f"file '{os.path.abspath(p)}'\n")

    output_path = os.path.join(output_dir, "output_video.mp4")
    subprocess.run([
        "ffmpeg", "-y",
        "-f", "concat", "-safe", "0", "-i", concat_path,
        "-vf", f"scale={original_width}:{original_height}"

• Confidence: 86% confidence
• Finding: This ffmpeg concat/render path processes generated file lists and user-influenced dimensions without robust validation. While it does not use a shell, media pipelines are a frequent attack surface for malformed inputs, path tricks, and resource exhaustion, and this function expands the skill from draft generation into arbitrary local media rendering.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

clip_path
            ]

        result = subprocess.run(cmd, capture_output=True)
        if result.returncode != 0:
            print(f"  Warning: clip {clip['clip_id']} render failed, skipping.")
            continue

• Confidence: 85% confidence
• Finding: This executes ffmpeg commands built from clip metadata and file paths without validating that clip times, audio paths, and output locations are trusted and within expected bounds. Even without shell injection, untrusted media inputs and paths can trigger unwanted file access or denial-of-service through expensive transcoding.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

from openai import OpenAI
    except ImportError:
        import subprocess, sys
        subprocess.run([sys.executable, "-m", "pip", "install", "openai",
                        "--break-system-packages", "-q"], check=True)
        from openai import OpenAI

• Confidence: 98% confidence
• Finding: Automatically installing Python packages at runtime materially increases the skill's execution privileges and supply-chain exposure. A video-editing skill should not mutate the host environment on import failure, especially with --break-system-packages, because it can install unexpected code and destabilize the system.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        import edge_tts
    except ImportError:
        subprocess.run([sys.executable, "-m", "pip", "install", "edge-tts",
                        "--break-system-packages", "-q"], check=True)
        import edge_tts
    clean = text.strip().strip("[]").strip()

• Confidence: 98% confidence
• Finding: The script installs a Python package at runtime via pip, which modifies the environment during normal execution and pulls executable code from an external package source without explicit consent. This expands the attack surface through dependency substitution, supply-chain compromise, and unexpected system changes, especially because it uses '--break-system-packages'.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import anthropic
    except ImportError:
        import subprocess, sys
        subprocess.run([sys.executable, "-m", "pip", "install", "anthropic",
                        "--break-system-packages", "-q"], check=True)
        import anthropic

• Confidence: 97% confidence
• Finding: The code automatically executes `pip install anthropic --break-system-packages` at runtime if the dependency is missing. This creates an unnecessary code execution and supply-chain risk path, modifies the host environment without consent, and is especially risky in an agent skill where dependency resolution should be controlled outside normal execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import anthropic
    except ImportError:
        import subprocess, sys
        subprocess.run([sys.executable, "-m", "pip", "install", "anthropic",
                        "--break-system-packages", "-q"], check=True)
        import anthropic

• Confidence: 97% confidence
• Finding: This is a second runtime package installation path in `refine_narration`, again invoking `pip` from application logic. Repeating the same behavior expands the attack surface and allows unreviewed environment mutation during ordinary processing of user content.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        import edge_tts
    except ImportError:
        subprocess.run(
            ["pip", "install", "edge-tts", "--break-system-packages", "-q"],
            check=True
        )

• Confidence: 98% confidence
• Finding: The code performs a runtime pip install of edge-tts, which modifies the host environment and pulls executable code from an external package source during skill execution. This creates supply-chain and environment-integrity risk, and the use of --break-system-packages increases the blast radius by overriding system package protections.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
        print("openai-whisper not found. Installing...")
        import subprocess
        subprocess.run([sys.executable, "-m", "pip", "install", "openai-whisper",
                        "--break-system-packages", "-q"], check=True)
        import whisper

• Confidence: 97% confidence
• Finding: The script automatically invokes pip to install a package at runtime when ImportError occurs, which modifies the host environment and pulls code from external package sources without explicit user approval. Even though the command is not shell-injected and the package name is hardcoded, runtime dependency installation expands the attack surface through supply-chain risk and unexpected environment changes, especially because it uses --break-system-packages.

Tainted flow: 'status' from requests.get (line 206, network input) → requests.get (network output)

Medium

• Category: Data Flow

Content

if state == "completed":
            print(f"\nGeneration complete!")
            dl_resp = requests.get(status["download_url"], stream=True, timeout=120)
            Path(output_path).parent.mkdir(parents=True, exist_ok=True)
            with open(output_path, "wb") as f:
                for chunk in dl_resp.iter_content(8192):

• Confidence: 95% confidence
• Finding: The code downloads from status["download_url"] returned by the remote API without validating the URL's scheme, host, or content type. If the service is compromised or responds unexpectedly, this can trigger server-side request forgery behavior, allow downloads from attacker-controlled endpoints, or fetch unsafe content into a local file.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill manifest says it generates CapCut draft templates, but this code also renders a final MP4 locally. That scope expansion increases access to local files, compute, and media-processing attack surface beyond what users would reasonably expect from the declared capability.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: This function calls Anthropic Claude despite the manifest only declaring Whisper, Qwen-VL-Plus, and edge-tts. Undeclared external model usage means user content may be transmitted to a third party unexpectedly, creating privacy and compliance risk.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Runtime package installation via pip is an unjustified capability for this skill and can alter the host environment, fetch and execute unreviewed code, and bypass package-management controls. In an agent skill, this is especially dangerous because dependency installation is not necessary to fulfill a normal editing request safely.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: Inspecting local JianYing/CapCut draft directories reaches into the user's environment beyond the narrowly stated task of building a draft payload. Even if intended to avoid naming conflicts, it reveals local application state and existing project names without clear necessity or consent.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: Runtime package installation is beyond the expected behavior of a media-processing skill and silently changes the host Python environment. If the package source or dependency chain is compromised, execution can lead to arbitrary code running under the user's privileges.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Installing packages at runtime is not justified by the stated editing workflow and introduces a supply-chain and arbitrary-environment-modification risk. In the context of an agent skill, this is more dangerous because users expect media processing, not package management with elevated package-system override behavior.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: Dynamic package installation is broader than the stated task of generating narration audio and gives the skill system-modifying capability it does not need at execution time. In this context, that is more dangerous because video editing workflows often process untrusted user media, yet this code also changes the runtime environment and fetches third-party code on demand.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: A tool presented as a local transcription helper should not silently gain package-management capability during normal execution. This is dangerous because it causes unannounced network/package retrieval and code installation on the machine, creating supply-chain exposure and violating least surprise for users who expect only local processing.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: For an audio transcription utility, runtime package installation is not necessary to fulfill its stated function and represents an unjustified privileged action. In the skill context, users may run this on workstations or agent hosts handling media files, so unexpected package installation increases operational and security risk beyond the task of transcription itself.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger phrases are so broad that the skill may auto-activate for general video-related requests unrelated to this workflow. In a high-capability agent, overbroad routing can unexpectedly grant shell, filesystem, and network behavior to conversations that did not require it.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The function base64-encodes extracted video frames and sends them to DashScope/Qwen-VL-Plus, which may expose sensitive visual data from user videos to a third-party service. There is no visible consent flow, redaction step, or disclosure in this module, making unexpected data exfiltration a real privacy issue.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script silently performs pip installation at runtime without warning, which downloads and executes code from external repositories and modifies the environment. Hidden environment mutation is dangerous in a skill because users and operators may not expect network access or package changes during ordinary media processing.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: Installing a package at runtime without warning or confirmation deprives the user of meaningful consent for a network and environment-modifying action. In agent contexts this is especially risky because execution may occur automatically on a workstation or server that the user expected to remain unchanged.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Narration text is sent through edge-tts, which typically relies on a remote service, yet the code provides no disclosure that user-provided or transcript-derived content may leave the local environment. This can expose sensitive speech, subtitles, or private video-derived text to third parties unexpectedly.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The function sends movie plot events, timestamps, descriptions, and possibly character metadata to Anthropic without any disclosure or consent flow. In a video editing skill, user media-derived content can be sensitive or copyrighted, so undisclosed third-party transmission creates a real privacy and data-governance risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill executes a `pip install` subprocess automatically and without user confirmation. Beyond transparency concerns, this actively changes the runtime environment and can pull unreviewed code from package sources, making the undisclosed action materially dangerous.

Static analysis

No suspicious patterns detected.