Audio SRT Workflow

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:14 AM UTC
• Version: 0.1.2

Overview

This skill is a straightforward subtitle-generation workflow that reads user-selected media/text files and writes subtitle or preview outputs, with expected local dependency and ffmpeg use.

Install and run this only in a project-specific virtual environment, review requirements.txt first, choose output paths carefully because existing files may be overwritten, and expect faster-whisper or its model runtime to download needed model assets on first use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Dependency Installation Lacks Transitive Version Locking and Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:77-82, references/command-templates.md:13-19, and scripts/requirements.txt:1
Vulnerability Type: Third-party software supply-chain exposure
Risk Level: Medium

Vulnerable Code

SKILL.md:77-82:

bash

if `faster-whisper` import fails:

```bash
# Review dependencies before installing:
cat "$SKILL_DIR/scripts/requirements.txt"
pip install -r "$SKILL_DIR/scripts/requirements.txt"

text

The executable command in this segment is:

```bash
cat "$SKILL_DIR/scripts/requirements.txt"
pip install -r "$SKILL_DIR/scripts/requirements.txt"

references/command-templates.md:13-19:

bash

python3 -m venv .venv
source .venv/bin/activate
# Review dependencies first:
cat "$SKILL_DIR/scripts/requirements.txt"
pip install -r "$SKILL_DIR/scripts/requirements.txt"

scripts/requirements.txt:1:

text

faster-whisper==1.2.1

Technical Analysis

The project pins the direct faster-whisper dependency to version 1.2.1, but it does not provide a fully resolved dependency lock file or cryptographic hashes for the package artifacts and their transitive dependencies. The documented pip install -r command therefore allows pip to resolve and download additional components from the configured package index at installation time.

Pinning only the direct dependency does not guarantee that every transitive package, platform-specific wheel, or future resolution result is identical to the set reviewed by the project maintainers. The absence of --require-hashes also means downloaded artifacts are not checked against project-approved hashes.

No evidence was found that faster-whisper==1.2.1 or any currently resolved dependency is malicious. The vulnerability is the lack of dependency integrity and reproducibility controls, which creates a supply-chain attack opportunity if an upstream package, artifact, package index, or dependency resolution is compromised.

Attack Path

1. An attacker co ...[truncated 1699 chars]

Remediation

View remediation

Remediation Suggestions

1. Generate a fully resolved lock file that pins all direct and transitive dependencies to exact versions for each supported platform and Python version.

2. Record cryptographic hashes for every approved package artifact and install with hash enforcement, for example:

   bash

   python3 -m pip install --require-hashes -r requirements.lock
   

3. Use a dependency-locking tool such as pip-tools, Poetry, or an equivalent reproducible-build workflow. Review lock-file changes before merging them.

4. Document and enforce an approved HTTPS package index, such as:

   bash

   python3 -m pip install \
     --index-url https://pypi.org/simple \
     --require-hashes \
     -r requirements.lock
   

5. Continue installing dependencies inside a dedicated, least-privileged virtual environment. Do not recommend installation with sudo or an administrative account.

6. Add automated dependency scanning and periodic lock-file updates to the maintenance process.

7. Where practical, verify package provenance or signatures and build releases in an isolated environment.

8. Update SKILL.md and references/command-templates.md so their installation examples use the locked, hash-verified requirements file.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill clearly instructs the agent/user to read environment variables, access local files, write outputs, and execute shell commands, but it does not declare any explicit tool scope or permissions boundary. That omission can cause over-broad execution in hosts that rely on manifest-declared permissions, increasing the risk of unintended file access, command execution, or environment leakage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The primary command template explicitly sets --language zh, and later notes also assume Chinese output behavior. The skill does mention collecting a language hint, but the example and notes do not clearly present language selection as user-controlled or explain why Chinese is the default.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/make_preview_mp4.py (reported line 114)May include surrounding context.

python

str(output_path),
    ]

    subprocess.run(cmd, check=True)
    print(f"Output: {output_path}")

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill tells the operator to run pip install directly from a requirements file without warning that this changes the local Python environment. While common, this can unexpectedly alter system or user environments, introduce dependency conflicts, or install unreviewed packages from the repository context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file documents a command that creates preview_check.mp4, which is a file-writing operation. The surrounding description does not warn the user that running the command will generate or potentially overwrite a local file, so the behavior lacks explicit disclosure in the skill documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This code writes directly to the user-specified or derived output path using write_text/open('w'), which can overwrite an existing subtitle file. Although the script's purpose is to generate an SRT, there is no confirmation prompt or explicit user-facing warning that existing output files at that path will be replaced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code creates parent directories automatically before running the subtitle pipeline, which is a filesystem-modifying action. Although the user selects an output path and completion is logged later, there is no explicit pre-action warning or confirmation that directories may be created and output files written.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The command includes ffmpeg's -y flag, which forces overwrite of the destination file without confirmation. If a user supplies an existing path, especially via automation or from the wrong working directory, important files at that path can be silently replaced, causing data loss.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.