Security audit
Security checks for vulnerabilities and agentic risk
This media diagnostic skill needs review because untrusted playlists can trigger requests to internal services and reads of unintended local files.
Use trusted playlists, or run the skill in an isolated environment without sensitive files or internal-network access. Before using untrusted playlists, request restrictions on segment schemes, destinations, and redirects. Repair commands remain suggestions requiring a separate request.
scripts/hls_check.pyUntrusted HLS segment URLs can trigger requests to internal services
The playlist provider can induce requests to loopback, private-network, or link-local services reachable from the diagnostic host. Reports expose response status and errors, enabling internal reachability probing. Arbitrary response-body disclosure or credential extraction is not established.
Although transcoding can address playback compatibility issues, this command performs remediation rather than diagnosis. It writes a converted media file, contradicting the explicit read-only declaration. The command does not show credential access or cloud API calls.
Although bitrate control is related to the declared diagnostic domain, this command applies encoding settings and creates a new media file rather than inspecting or reporting media properties. That behavior contradicts the explicit read-only scope. No credential access or cloud API calls are shown.
Although converting audio to AAC-LC can address codec compatibility issues, this command performs remediation rather than diagnosis. It writes a converted media file, directly contradicting the explicit read-only declaration.
The command is related to media troubleshooting, but it actively produces an altered output file instead of merely inspecting the input. This conflicts with the explicit read-only declaration. No credential access or cloud API calls are shown.
The command is relevant to the declared moov atom topic, but '-c copy -movflags +faststart output.mp4' creates a remuxed media file with metadata relocated for progressive playback. This write operation contradicts the stated read-only scope. No credential access or cloud API calls are shown.
Transcoding is related to resolving codec compatibility problems, but these commands perform remediation rather than diagnosis. They encode video and write files, directly contradicting the explicit read-only limitation. The chunk contains no diagnostic inspection commands.
Although the encoding settings relate to the declared topic of live latency, this command changes the media representation and publishes a stream rather than inspecting or diagnosing it. Those operations exceed the explicit read-only scope. The RTMP URL is a placeholder, so the snippet does not identify an actual recipient, but its intended publishing behavior is clear.
The command uses an output filename and the -shortest option to produce a modified media artifact. Although related to media troubleshooting, this is a corrective transformation, not read-only analysis. The snippet does not show credential access or cloud API calls.
Both commands specify output.flv as a destination. The ffmpeg command copies media streams while adding a keyframe index, and yamdi similarly produces an indexed FLV output. Although related to playback troubleshooting, these are file-producing remediation operations and therefore contradict the declared read-only scope. No credential access or cloud API calls are shown.
The command creates output TS files using a selected input time range and the segment muxer. Although this operation relates to media processing, it is an undeclared transformation capability and directly contradicts the stated read-only restriction. No credential use or cloud API calls are shown.
The command uses stream copying and the HLS output muxer to generate output.m3u8 and associated segments. Although HLS is relevant to the declared domain, generating media outputs is a materially different operation from read-only inspection and directly contradicts the stated restriction.
The command changes the video encoding and produces an output file. Although this conversion could remedy codec compatibility problems, it performs remediation rather than merely diagnosing them and directly conflicts with the declared read-only behavior.
Although GOP configuration is relevant to the declared diagnostic topic, this command changes encoding parameters and produces an outgoing stream rather than inspecting media. That conflicts with the explicit read-only scope. The RTMP destination is a placeholder, so the snippet does not establish transmission to a specific server, credential use, or cloud API access.
Although related to media troubleshooting, this command produces and transmits a modified media stream rather than merely diagnosing the input. That exceeds the explicit read-only scope. The RTMP URL is a placeholder, so the snippet does not identify an actual recipient or establish that transmission occurred.
Without declared permissions the skill's intent is opaque and cannot be validated.
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
## Absolute Rules
- **Read-only**: this skill only inspects and reports. It never modifies, deletes, or re-encodes any file, and never pushes to any stream endpoint.
- **User-specified target only — ABSOLUTE PROHIBITION**: only the single file or URL explicitly provided by the user may be probed. When the target does not exist or is unreachable, do NOT list, search, or scan anything to locate it or a substitute: no directory listings (e.g. `ls -la /home/user/downloads/`), no file searches (`find /home/user -name "*.ts"`), no glob patterns (`glob **/broken_video.mp4`), no guessing URLs, no probing unspecified addresses. Instead take the `unreachable` degraded conclusion from triage directly and report why the given target failed.
- **No credentials**: no cloud credentials, API keys, or tokens are required, requested, or used. The skill never calls any cloud API.
- **No remediation execution**: repair commands (ffmpeg examples) are only *suggested* in the report. Never execute any repai
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## Credentials
- **No credentials required.** All analysis runs locally against the user-provided file or URL using ffprobe/mediainfo and plain HTTP requests.
- This skill does not call any cloud API. Never ask the user for AccessKey, STS token, or any cloud configuration.
## Trigger Conditions
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
"Until then, refer to the degraded conclusion above as a "
"limited structural check"]
actions.append("中文：安装命令供用户或环境管理员参考（Agent 不代为安装）——"
"macOS: brew install ffmpeg; Ubuntu/Debian: sudo apt install ffmpeg; "
"Windows: winget install ffmpeg")
attach_report(results, summary, "needs_attention", actions)
emit_json(results)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
-2: executable not found
"""
try:
result = subprocess.run(
cmd, capture_output=True, text=True, timeout=timeout
)
return result.stdout, result.returncode
The docstring explicitly specifies that the user-facing stderr warning must be English. This is a natural-language output requirement, rather than a readability idiom, and no language opt-in or justified locale constraint is provided.