Subtitle Generator

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:49 AM UTC
• Version: 1.0.1

Overview

This skill does what it claims: it helps generate subtitles from user-provided video/audio using SenseAudio, with some privacy and dependency cautions but no hidden or malicious behavior found.

Install this only if you are comfortable using SenseAudio as the transcription provider. Treat videos and extracted audio as potentially sensitive because they are uploaded to a third-party API, keep SENSEAUDIO_API_KEY in an environment variable or secret manager, review generated subtitles before publishing, and install ffmpeg/dependencies from trusted sources in a non-privileged environment where practical.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13
• Finding: Unpinned Third-Party Runtime Dependencies## Vulnerability Details **File Location**: `SKILL.md`, lines 13–16 and 32–40 **Vulnerability Type**: Unpinned dependency installation **Risk Level**: Medium The skill declares and recommends installing third-party packages and system tools without fixed versions or integrity hashes. ```yaml install: - kind: uv package: requests - kind: uv package: pydub ``` ```bash pip install requests pydub ``` ```bash # Ubuntu/Debian sudo apt-get install ffmpeg # macOS brew install ffmpeg ``` ### Technical Analysis Because no versions or package hashes are specified, each installation can resolve to different dependency releases. The effective code installed and executed is therefore mutable and is not fully represented by the audited artifact. The named packages and installation sources are not inherently malicious, and no dependency-confusion package or typosquatted name was identified. However, an upstream compromise, malicious future release, compromised package index, or unsafe package-resolution configuration could cause unreviewed code to execute during installation or import. ### Attack Path 1. An attacker compromises a dependency release, package distribution account, configured package index, or dependency-resolution path. 2. The user follows the skill instructions or the skill framework processes the unpinned installation declarations. 3. The package manager selects the attacker-controlled release because no reviewed version or hash is enforced. 4. Malicious installation hooks or imported runtime code execute under the account running the installation or skill. 5. If installation is performed with elevated privileges, the malicious component may inherit those elevated privileges. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the package installer or skill process. This may expose accessible files, environment variables such as ` ...[truncated 327 chars]
• Remediation: ## Remediation Suggestions - Pin every Python dependency to a reviewed version. - Generate and commit a reproducible lockfile containing transitive dependencies. - Require cryptographic hashes during installation, such as with `pip --require-hashes` or an equivalent locked `uv` workflow. - Explicitly configure trusted package indexes and disable unexpected supplemental indexes. - Pin or document tested FFmpeg versions and obtain system packages only from trusted, authenticated repositories. - Run dependency installation and media processing under a non-privileged account or isolated environment. - Use automated dependency scanning and review updates before changing locked versions.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:225
• Finding: Unescaped Input Embedded in ASS and FFmpeg Filter Syntax## Vulnerability Details **File Location**: `SKILL.md`, lines 225–233 and 271–278 **Vulnerability Type**: Parser injection through unsafe string interpolation **Risk Level**: Medium Transcript text is inserted directly into ASS event records without escaping ASS control syntax or record delimiters: ```python for segment in segments: start = format_timestamp_ass(segment["start"]) end = format_timestamp_ass(segment["end"]) text = segment["text"] ass_content += f"Dialogue: 0,{start},{end},{style},,0,0,0,,{text}\n" ``` A caller-provided subtitle path is also interpolated directly into an FFmpeg filter expression: ```python def burn_subtitles(video_file, subtitle_file, output_file): cmd = [ "ffmpeg", "-i", video_file, "-vf", f"subtitles={subtitle_file}", "-c:a", "copy", output_file ] subprocess.run(cmd, check=True) ``` ### Technical Analysis Passing an argument list to `subprocess.run` avoids command interpretation by a system shell, so the shown code does not establish shell-command injection. However, the `-vf` argument is parsed separately by FFmpeg as filter-graph syntax. Characters meaningful to the FFmpeg filter parser can alter interpretation of an unescaped subtitle path or cause processing to fail. Similarly, ASS is a structured format with event records, override tags, and newline semantics. Untrusted transcript content inserted without encoding can introduce unintended formatting instructions or additional content structure. The `style` value is also directly interpolated into an ASS field and should be constrained. ### Attack Path **ASS content manipulation:** 1. An attacker supplies audio containing content that the transcription service renders as ASS-sensitive text, or otherwise controls transcript data passed to `format_ass`. 2. The generated text is inserted into a `Dialogue` record without escaping or normalization. 3. ...[truncated 1311 chars]
• Remediation: ## Remediation Suggestions - Escape ASS control sequences, override tags, and line breaks before inserting transcript text into event records. - Normalize newlines and reject unexpected record delimiters in transcript and style fields. - Restrict `style` to a fixed allowlist of declared style names. - Use a dedicated ASS serialization library rather than constructing records through string concatenation. - Canonicalize `subtitle_file`, require it to resolve beneath an approved working directory, and verify that it is a regular subtitle file. - Escape filenames according to FFmpeg filter-graph and subtitles-filter rules rather than relying only on subprocess argument separation. - Prefer a tested helper for constructing FFmpeg filter expressions. - Add tests covering spaces, quotes, colons, commas, brackets, backslashes, newlines, and ASS override syntax in paths and transcript text. - Execute FFmpeg in a sandbox with minimal filesystem access and resource limits.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Note: You'll also need `ffmpeg` installed for video audio extraction:
```bash
# Ubuntu/Debian
sudo apt-get install ffmpeg

# macOS
brew install ffmpeg

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to upload extracted audio to a third-party API, but it does not clearly warn that user media leaves the local system. Audio and video often contain sensitive personal, business, or regulated information, so undisclosed transmission can lead to privacy, compliance, and confidentiality violations.

External Transmission

Medium

• Category: Data Exfiltration

Content

API_KEY = os.environ["SENSEAUDIO_API_KEY"]

def transcribe_for_subtitles(audio_file, language="zh"):
    url = "https://api.senseaudio.cn/v1/audio/transcriptions"

    headers = {"Authorization": f"Bearer {API_KEY}"}
    files = {"file": open(audio_file, "rb")}

• Confidence: 96% confidence
• Finding: This code performs explicit external transmission of user-provided audio to api.senseaudio.cn for transcription. In the context of a media-processing skill, that behavior is expected, but it still creates a real data-exfiltration/trust-boundary risk if users are not informed and if sensitive recordings are processed.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: `transcribe_for_subtitles` is defined to accept only `audio_file` and `language`, but the later example claims translation support by passing `target_language=lang`. This is an active contradiction between the documentation/example code and the actual function interface shown in the file.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest description limits the skill to generating synchronized subtitles from video audio, which implies producing transcript/subtitle outputs. The documented `burn_subtitles` function goes beyond subtitle generation by rendering subtitles back into video and producing a modified media file.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The skill requires a third-party API key and depends on an external service, but it does not include clear guidance on credential handling or warn users about that dependency. This can lead to accidental misuse of secrets, unexpected data sharing, and weak operator understanding of trust boundaries.

Static analysis

No suspicious patterns detected.