ClawHub
Back to skill

Security audit

Video to SRT

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent local video-to-subtitle helper, with expected but important side effects around dependency installation, model downloads, cache creation, and subtitle file overwrites.

Install only if you are comfortable with the skill creating a local virtual environment/cache and downloading Python/model dependencies. Use explicit output directories, use --language auto or the correct language for non-Chinese media, and avoid --copy-next-to-input when you do not want an existing .srt beside the source media replaced.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/run_local_subtitles.sh:18
Finding

Automatic Installation of Non-Reproducible Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: scripts/run_local_subtitles.sh:18-20; scripts/requirements.txt:1
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: Medium

Vulnerable Code:

bash
if ! "$VENV_DIR/bin/python3" -c "import faster_whisper" >/dev/null 2>&1; then
  "$VENV_DIR/bin/python3" -m pip install -U pip >/dev/null
  "$VENV_DIR/bin/python3" -m pip install -r "$SCRIPT_DIR/requirements.txt" >/dev/null
fi
text
faster-whisper>=1.1.0,<2

Technical Analysis

The normal execution path automatically upgrades pip and installs faster-whisper from the package source configured for pip when the dependency is not already available. The requirement permits any release from version 1.1.0 up to, but excluding, version 2. Neither the direct dependency nor its transitive dependencies are locked to exact reviewed versions or verified using cryptographic hashes.

As a result, installations performed at different times can retrieve and execute different package code. The effective dependency source can also be influenced by pip configuration and environment settings outside this project. A compromised package release, compromised package index, or attacker-controlled index configured on the host could therefore introduce arbitrary code during installation or subsequent import.

Attack Path

  1. An attacker compromises a permitted future dependency release or causes the victim's pip configuration to use an attacker-controlled package source.
  2. The user invokes scripts/run_local_subtitles.sh in an environment where faster_whisper is not importable from the virtual environment.
  3. The wrapper upgrades pip and resolves the broad dependency specification from the configured source.
  4. pip downloads and installs the unreviewed package and its transitive dependencies.
  5. Malicious package installation hooks or imported runtime code execu ...[truncated 629 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin all direct and transitive dependencies to exact, reviewed versions using a generated lock file.
  • Record cryptographic hashes for every distribution and install with pip's --require-hashes option.
  • Avoid upgrading pip automatically during ordinary skill execution. Pin and provision a reviewed pip version separately.
  • Configure an explicit trusted package index rather than relying on ambient pip configuration.
  • Prefer an internally mirrored or otherwise controlled dependency repository for production use.
  • Request explicit user approval before performing network-dependent package installation.
  • Regularly regenerate the lock file through a controlled review and vulnerability-scanning process.

T09 · Insecure Skill Coding Practices

Note
Location
scripts/transcribe_to_srt.py:192
Finding

Predictable Subtitle Destinations Are Overwritten Without Confirmation

Content
View full analysis

Vulnerability Details

File Location: scripts/transcribe_to_srt.py:192-204, scripts/transcribe_to_srt.py:211-213, scripts/transcribe_to_srt.py:238-245
Vulnerability Type: Uncontrolled file overwrite and symbolic-link destination handling
Risk Level: Low

Vulnerable Code:

python
def write_srt(captions: List[Caption], output_path: Path) -> None:
    lines: List[str] = []
    for index, caption in enumerate(captions, start=1):
        lines.append(str(index))
        lines.append(
            f"{format_timestamp(caption.start)} --> {format_timestamp(caption.end)}"
        )
        lines.append(caption.text)
        lines.append("")
    output_path.write_text("\n".join(lines), encoding="utf-8")


def maybe_copy_next_to_input(output_path: Path, input_path: Path) -> Optional[Path]:
    target_path = input_path.with_suffix(".srt")
    shutil.copy2(output_path, target_path)
    return target_path
python
input_path = ensure_input(args.input)
output_dir = ensure_output_dir(args.output_dir)
output_path = output_dir / f"{input_path.stem}.srt"
python
write_srt(captions, output_path)
print(f"Detected language: {info.language} (prob={info.language_probability:.3f})")
print(f"Subtitle cues: {len(captions)}")
print(f"SRT written: {output_path}")

if args.copy_next_to_input:
    copied_path = maybe_copy_next_to_input(output_path, input_path)
    print(f"Copied next to input: {copied_path}")

Technical Analysis

Subtitle destinations are deterministically derived from the input file stem. Path.write_text() truncates and replaces an existing output file, while shutil.copy2() replaces an existing destination when --copy-next-to-input is enabled. The code performs no existence check, overwrite confirmation, exclusive creation, or symbolic-link rejection.

If a destination is already a symbolic link, the write operation can follow that link and ...[truncated 1525 chars]

Remediation
View remediation

Remediation Suggestions

  • Refuse to write when the destination already exists unless the user supplies an explicit --force option.
  • Check destinations with lstat() and reject symbolic links before writing or copying.
  • Create new files using exclusive creation semantics, such as mode x, where overwriting is not requested.
  • For intentional replacement, write to a securely created temporary file in the same directory and atomically replace the destination only after validation.
  • Revalidate the destination immediately before committing the file to reduce time-of-check to time-of-use exposure.
  • Warn users clearly before replacing an existing subtitle beside the source media.
  • Where supported, use directory-relative operations and no-follow flags to harden handling in shared directories.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill instructs the agent to create task folders, generate subtitle files, and optionally copy outputs next to the source media, which are file-write capabilities, but it does not declare any tool scope or permissions. That mismatch weakens guardrails because an orchestrator or reviewer cannot clearly constrain or audit the write operations the skill expects to perform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The workflow tells the agent to run a wrapper script immediately, while only later mentioning that it may install packages or download models. Omitting that warning from the main workflow reduces informed consent and can cause unexpected code execution, network access, disk usage, and environment changes before the user is aware of them.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Defaulting to --language zh without user opt-in can produce incorrect transcription results for non-Chinese media and silently degrade output quality. While this is not a classic code-execution issue, it is a risky default because it can mis-handle user data and cause misleading or unusable subtitles unless the user notices.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Silently installing dependencies without warning reduces user awareness that executing the skill will make network requests and run newly downloaded code. In the context of a supposedly local workflow, this hidden behavior increases the chance users unknowingly accept supply-chain risk and environment modification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script performs network-based dependency installation at runtime even though the skill is presented as a local subtitle workflow. This expands the trust boundary from local file processing to arbitrary package retrieval during execution, creating supply-chain and reproducibility risks if package sources or resolved versions are compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

A local media transcription skill does not inherently need permission to fetch and install code during normal execution, so runtime package installation is an unnecessary capability. If abused or if upstream packages are tampered with, running the skill could execute untrusted code on the user's machine under the user's account.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The CLI sets --language to zh by default, which imposes a specific language/locale choice without user opt-in. The policy allows locale constraints only when justified or optional, but this script defaults to Chinese transcription rather than auto-detection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code writes to the filesystem by creating cache directories and, if absent, a Python virtual environment. The script contains no user-facing echo/print, confirmation, or explanatory comment near these side effects, so users invoking it may not realize it will modify the local workspace.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.