Subtitle Generator

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:49 AM UTC
• Version: 1.0.1

Overview

This skill does what it claims: it helps generate subtitles from user-provided video/audio using SenseAudio, with some privacy and dependency cautions but no hidden or malicious behavior found.

Install this only if you are comfortable using SenseAudio as the transcription provider. Treat videos and extracted audio as potentially sensitive because they are uploaded to a third-party API, keep SENSEAUDIO_API_KEY in an environment variable or secret manager, review generated subtitles before publishing, and install ffmpeg/dependencies from trusted sources in a non-privileged environment where practical.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Runtime Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–16 and 32–40
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

The skill declares and recommends installing third-party packages and system tools without fixed versions or integrity hashes.

yaml

install:
  - kind: uv
    package: requests
  - kind: uv
    package: pydub

bash

pip install requests pydub

bash

# Ubuntu/Debian
sudo apt-get install ffmpeg

# macOS
brew install ffmpeg

Technical Analysis

Because no versions or package hashes are specified, each installation can resolve to different dependency releases. The effective code installed and executed is therefore mutable and is not fully represented by the audited artifact.

The named packages and installation sources are not inherently malicious, and no dependency-confusion package or typosquatted name was identified. However, an upstream compromise, malicious future release, compromised package index, or unsafe package-resolution configuration could cause unreviewed code to execute during installation or import.

Attack Path

1. An attacker compromises a dependency release, package distribution account, configured package index, or dependency-resolution path.
2. The user follows the skill instructions or the skill framework processes the unpinned installation declarations.
3. The package manager selects the attacker-controlled release because no reviewed version or hash is enforced.
4. Malicious installation hooks or imported runtime code execute under the account running the installation or skill.
5. If installation is performed with elevated privileges, the malicious component may inherit those elevated privileges.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the package installer or skill process. This may expose accessible files, environment variables such as ` ...[truncated 327 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every Python dependency to a reviewed version.
• Generate and commit a reproducible lockfile containing transitive dependencies.
• Require cryptographic hashes during installation, such as with pip --require-hashes or an equivalent locked uv workflow.
• Explicitly configure trusted package indexes and disable unexpected supplemental indexes.
• Pin or document tested FFmpeg versions and obtain system packages only from trusted, authenticated repositories.
• Run dependency installation and media processing under a non-privileged account or isolated environment.
• Use automated dependency scanning and review updates before changing locked versions.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:225

Finding

Unescaped Input Embedded in ASS and FFmpeg Filter Syntax

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 225–233 and 271–278
Vulnerability Type: Parser injection through unsafe string interpolation
Risk Level: Medium

Transcript text is inserted directly into ASS event records without escaping ASS control syntax or record delimiters:

python

for segment in segments:
    start = format_timestamp_ass(segment["start"])
    end = format_timestamp_ass(segment["end"])
    text = segment["text"]

    ass_content += f"Dialogue: 0,{start},{end},{style},,0,0,0,,{text}\n"

A caller-provided subtitle path is also interpolated directly into an FFmpeg filter expression:

python

def burn_subtitles(video_file, subtitle_file, output_file):
    cmd = [
        "ffmpeg", "-i", video_file,
        "-vf", f"subtitles={subtitle_file}",
        "-c:a", "copy",
        output_file
    ]
    subprocess.run(cmd, check=True)

Technical Analysis

Passing an argument list to subprocess.run avoids command interpretation by a system shell, so the shown code does not establish shell-command injection. However, the -vf argument is parsed separately by FFmpeg as filter-graph syntax. Characters meaningful to the FFmpeg filter parser can alter interpretation of an unescaped subtitle path or cause processing to fail.

Similarly, ASS is a structured format with event records, override tags, and newline semantics. Untrusted transcript content inserted without encoding can introduce unintended formatting instructions or additional content structure. The style value is also directly interpolated into an ASS field and should be constrained.

Attack Path

ASS content manipulation:

1. An attacker supplies audio containing content that the transcription service renders as ASS-sensitive text, or otherwise controls transcript data passed to format_ass.
2. The generated text is inserted into a Dialogue record without escaping or normalization.

...[truncated 1311 chars]

Remediation

View remediation

Remediation Suggestions

• Escape ASS control sequences, override tags, and line breaks before inserting transcript text into event records.
• Normalize newlines and reject unexpected record delimiters in transcript and style fields.
• Restrict style to a fixed allowlist of declared style names.
• Use a dedicated ASS serialization library rather than constructing records through string concatenation.
• Canonicalize subtitle_file, require it to resolve beneath an approved working directory, and verify that it is a regular subtitle file.
• Escape filenames according to FFmpeg filter-graph and subtitles-filter rules rather than relying only on subprocess argument separation.
• Prefer a tested helper for constructing FFmpeg filter expressions.
• Add tests covering spaces, quotes, colons, commas, brackets, backslashes, newlines, and ASS override syntax in paths and transcript text.
• Execute FFmpeg in a sandbox with minimal filesystem access and resource limits.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

Note: You'll also need ffmpeg installed for video audio extraction:

bash

# Ubuntu/Debian
sudo apt-get install ffmpeg

# macOS
brew install ffmpeg

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to upload extracted audio to a third-party API, but it does not clearly warn that user media leaves the local system. Audio and video often contain sensitive personal, business, or regulated information, so undisclosed transmission can lead to privacy, compliance, and confidentiality violations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

This code performs explicit external transmission of user-provided audio to api.senseaudio.cn for transcription. In the context of a media-processing skill, that behavior is expected, but it still creates a real data-exfiltration/trust-boundary risk if users are not informed and if sensitive recordings are processed.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

API_KEY = os.environ["SENSEAUDIO_API_KEY"]

def transcribe_for_subtitles(audio_file, language="zh"):
    url = "https://api.senseaudio.cn/v1/audio/transcriptions"

    headers = {"Authorization": f"Bearer {API_KEY}"}
    files = {"file": open(audio_file, "rb")}

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

transcribe_for_subtitles is defined to accept only audio_file and language, but the later example claims translation support by passing target_language=lang. This is an active contradiction between the documentation/example code and the actual function interface shown in the file.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description limits the skill to generating synchronized subtitles from video audio, which implies producing transcript/subtitle outputs. The documented burn_subtitles function goes beyond subtitle generation by rendering subtitles back into video and producing a modified media file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill requires a third-party API key and depends on an external service, but it does not include clear guidance on credential handling or warn users about that dependency. This can lead to accidental misuse of secrets, unexpected data sharing, and weak operator understanding of trust boundaries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.