ClawHub
Back to skill

Security audit

视频批量转录

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it deserves Review because it can use browser session cookies and write files derived from remote media metadata without adequate safeguards.

Review before installing. Use a dedicated virtual environment and output directory, avoid --cookies-from-browser unless truly needed, prefer site-scoped exported cookie files stored outside shared folders, and only process content you are authorized to download. The path-building bug should be fixed before using untrusted URLs because a crafted remote title may cause files to be written outside the chosen output directory.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/batch_transcript.py:610
Finding

Remote Media Metadata Allows Output Path Traversal

Content
View full analysis
Remediation
View remediation
Path: base = base.resolve() candidate = (base / name).resolve() candidate.relative_to(base) return candidate ``` 3. Apply containment validation separately to collection directories, episode directories, and every generated file. 4. Prefer generated directory names based on trusted numeric indices and validated media IDs. Treat the human-readable title only as an optional sanitized suffix. 5. Avoid silently overwriting existing files. Use exclusive creation where practical, or explicitly verify that the destination is a regular file inside the approved output tree. 6. Add tests covering absolute paths, nested separators, `../` traversal, Windows separators, drive letters, Unicode separators, control characters, and symbolic links. ]]>

T08 · Insecure Dependencies

Warning
Location
requirements.txt:4
Finding

Dependencies Are Installed Without Exact Version or Integrity Pinning

Content
View full analysis
=2024.0.0 faster-whisper>=1.0.0 pandas>=2.0.0 python-dateutil>=2.8.0 # Optional dependency python-docx>=1.0.0 ``` The Skill instructs users to install the dependency set directly: ```bash pip install -r requirements.txt ``` ### Technical Analysis All declared dependencies use open-ended lower bounds and have no cryptographic hashes. Consequently, installation may select any future release satisfying the minimum version, including releases that were never reviewed as part of this audit. Python package installation can execute package build logic, and imported dependencies run with the privileges of the invoking user. The absence of a lock file or hash validation means the effective installed code can change without any modification to the audited project. This does not establish that any currently named package is malicious. The vulnerability is the lack of reproducible and integrity-verified dependency resolution, which increases exposure to compromised upstream releases, dependency takeover, incompatible updates, or package-index attacks. ### Attack Path 1. A listed package or one of its transitive dependencies is compromised, replaced, or publishes a malicious future release. 2. The malicious release still satisfies the open-ended version constraint. 3. A user follows the documented `pip install -r requirements.txt` instruction. 4. Pip resolves and downloads the unreviewed release. 5. Malicious build, installation, or import-time code executes with the installing or running user's privileges. 6. The dependency may access files, credentials, network resources, or other data available to that user. ### Impact Assessment The impact can include arbit ...[truncated 531 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (34)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · PUBLISH.md (reported line 90)May include surrounding context.

script.py
--url "https://space.bilibili.com/xxx/collectiondetail?sid=xxx"
--output-dir "~/video-notes"

text

### GPU 加速
```bash
python scripts/batch_transcript.py \
  --url "xxx" \
  --device cuda \
  --model medium

使用 Cookies（需要登录的网站）

bash
# 从浏览器获取 cookies
python scripts/batch_transcript.py \
  --url "https://youtube.com/watch?v=xxx" \
  --cookies-from-browser chrome

更新日志

v1.0.0 (2026-03-05)

  • 初始版本发布
  • 支持 1000+ yt-dlp 兼容网站
  • GPU 加速转录（faster-whisper）
  • 结构化笔记生成
  • 断点续传支持
  • 多格式导出
  • Cookies 登录支持
  • 术语校正功能
  • 并行处理支持

技术实现

核心组件

  • yt-dlp: 视频/音频下载（支持 1000+ 网站）
  • faster-whisper: GPU 加速语音识别
  • 自定义脚本: 批量处理、笔记生成、术语校正

性能优化

  • GPU 加速（CUDA）
  • 多进程并行处理
  • 断点续传
  • 智能缓存

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 96)May include surrounding context.

----| | --url | 视频/合集 URL | 必填 | | --output-dir | 输出目录 | ~/video-notes | | --episodes | 指定集数 (e.g., "1-5,8,10") | 全部 | | --model | Whisper 模型 (tiny/base/small/medium/large) | small | | --device | 设备 (auto/cuda/cpu) | auto | | --language | 语言代码 (auto=自动检测) | auto | | --format | 视频格式选择 | bestaudio | | --cookies-from-browser | 浏览器 cookies (chrome/firefox/safari/edge/brave/opera) | 无 | | --cookies | cookies 文件路径 | 无 | | --terminology | 术语表 JSON 文件路径 | 内置 | | --workers | 并行处理数 | 1 | | --no-resume | 禁用断点续传 | 否 | | --check-env | 仅检查环境 | 否 |

输出结构

text
~/video-notes/
├── youtube_合集名称/
│   ├── 001_视频标题/
│   │   ├── audio.mp3          # 音频文件
│   │   ├── transcript.txt     # 原始转录
│   │   ├── notes.md          # 结构化笔记
│

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · REFACTOR_REPORT.md (reported line 61)May include surrounding context.

Hulu、HBO、Disney+、Amazon Prime

🎵 音频平台（3+）

  • SoundCloud、Bandcamp、Spotify

📚 教育平台（5+）

  • Coursera、edX、Udemy、Khan Academy、TED

4. 新增功能

网站自动检测

python
def detect_site(self, url: str) -> Optional[Dict[str, Any]]:
    """自动检测视频来源网站"""

Cookies 配置支持

bash
# 从浏览器获取
--cookies-from-browser chrome

# 使用 cookies 文件
--cookies "cookies/netflix.txt"

网站特定优化

  • YouTube: 推荐 cookies 避免 403
  • B 站：部分合集需要登录
  • 抖音：通常需要 cookies
  • Netflix: 必须 cookies 文件

5. 文件结构

text
video-batch-transcript/
├── SKILL.md                    # 技能文档（已更新）
├── README.md                   # 使用说明（已更新）
├── PUBLISH.md                  # 发布说明（新增）
├── requirements.txt            # Python 依赖（已更新）
├── scripts/
│   ├�

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The description presents a full-featured batch video transcription tool, but the supplied code chunk is limited to checking whether the runtime environment has the expected dependencies and GPU support. While the script references packages and supported sites consistent with the broader project theme, its actual behavior is purely diagnostic/informational. That is a materially different primary purpose from the declared end-user functionality, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

The matched pattern is triggered by repeated --cookies-from-browser guidance, which is not proof of malware by itself, but it does describe behavior strongly associated with credential access. In an agent skill, recommending automatic extraction of browser cookies materially increases the risk of credential theft, session hijacking, or overcollection if the implementation reads more browser data than strictly needed.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

l?sid=xxx"
--output-dir "~/video-notes"

YouTube 播放列表

python scripts/batch_transcript.py
--url "https://www.youtube.com/playlist?list=xxx"
--output-dir "~/video-notes"

text

## 高级功能

### 1. 使用 Cookies（需要登录的网站）

```bash
# 从浏览器获取 cookies（推荐）
python scripts/batch_transcript.py \
  --url "https://www.youtube.com/watch?v=xxx" \
  --cookies-from-browser chrome

# 支持浏览器：chrome, firefox, safari, edge, brave, opera

# 或使用 cookies 文件
python scripts/batch_transcript.py \
  --url "https://www.netflix.com/title/xxx" \
  --cookies "cookies/netflix.txt"

2. 指定视频质量

bash
# 下载最佳质量
python scripts/batch_transcript.py \
  --url "xxx" \
  --format "best"

# 下载 1080p
python scripts/batch_transcript.py \
  --url "xxx" \
  --format "bestvideo[height<=1080]+bestaudio/best[height<=1080]"

# 仅音频
python scripts/batch_transcript.py \
  --url "xxx" \
  --format "bestaudio"

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · examples/usage_examples.md (reported line 16)May include surrounding context.

使用示例

示例 1: YouTube 教程系列

bash
# 下载整个播放列表并转录
python scripts/batch_transcript.py \
  --url "https://www.youtube.com/playlist?list=PLxxx" \
  --output-dir "~/youtube-ml-course" \
  --device cuda \
  --model medium

# 使用 cookies 避免 403 错误
python scripts/batch_transcript.py \
  --url "https://www.youtube.com/playlist?list=PLxxx" \
  --cookies-from-browser chrome

示例 2: B 站 UP 主合集

bash
# 下载整个合集
python scripts/batch_transcript.py \
  --url "https://space.bilibili.com/123/channel/collectiondetail?sid=456" \
  --output-dir "~/bilibili-ai-series" \
  --episodes "1-20"

# 下载 UP 主频道所有视频
python scripts/batch_transcript.py \
  --url "https://space.bilibili.com/123/video" \
  --output-dir "~/bilibili-uploader"

示例 3: 抖音合集

bash
# 抖音合集（需要 cookies）
python scripts/batch_transcript.py \
  --url "https://www.douyin.com/collection/xxx" \
  --output-d

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
77% confidence
Finding

The browser-cookie extraction capability is not inherently malware, but it does access highly sensitive authentication material from a local browser profile and feeds it into remote-content retrieval. In a skill that processes arbitrary user-supplied URLs across many sites, this materially raises the risk of credential misuse, over-collection of account data, and accidental access to private subscription or account-bound content if invoked without strong safeguards.

Content

Scanner excerpt · scripts/batch_transcript.py (reported line 295)May include surrounding context.

python
f"检测到网站：{site_info['name']}")
            if site_info['notes']:
                print(f"提示：{site_info['notes']}")
            
            # YouTube 特别处理
            if site_info['id'] == 'youtube':
                # 优先使用 cookies
                if not self.cookies_from_browser and not self.cookies_file:
                    print("提示：YouTube 建议使用 --cookies-from-browser chrome 避免 403 错误")
        
        return opts
    
    def get_collection_info(self, url: str) -> Dict[str, Any]:
        """
        获取合集/视频信息
        
        Args:
            url: 视频或合集 URL
            
        Returns:
            信息字典
        """
        print(f"正在获取信息：{url}")
        
        ydl_opts = {
            'quiet': True,
            'no_warnings': True,
            'extract_flat': 'in_playlist',  # 快速获取列表
        }
        
        # 添加 cookies 配置
        if self.cookies_from_br

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The publication text promotes downloading from many third-party and logged-in sites but does not warn users about legal/privacy risks, site terms, or the sensitivity of authenticated content. In a skill explicitly supporting browser-cookie based access, missing warnings can lead users to unintentionally process private or restricted data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README instructs users to supply browser-derived cookies or cookies files for logged-in sites, including streaming services, but does not warn that these artifacts are active authentication credentials. Mishandling them can expose account access, session tokens, or paid-service access to other users, logs, shell history, or insecure storage locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The report explicitly instructs users to supply authentication cookies from a browser or a local file, including for paid or login-gated services, but provides no warning about the sensitivity of those credentials or how they should be protected. In skill context, this increases the chance that users expose session tokens, commit cookie files to disk or source control, or use overly broad browser extraction in unsafe environments.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding

The skill documents shell execution plus file read/write behavior but does not declare any tool scope such as allowed-tools or permissions. In an agent environment, this weakens containment and makes it easier for the skill to invoke broader capabilities than a reviewer or policy engine expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The documentation normalizes processing login-gated streaming content without any privacy, account-security, or legal-use warning. In this context, users may provide authenticated sessions to third-party tooling without understanding the exposure of personal account data or the sensitivity of downloaded protected content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs users to pull cookies from a browser or provide exported cookie files for authenticated sites, but gives no warning that these are active session credentials. In an agent/tooling context, browser-cookie access can expose account sessions far beyond the target site and can enable unauthorized account access if mishandled or logged.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

These examples instruct users to supply browser-derived or exported cookies for logged-in platforms but provide no security guidance on handling those cookies as secrets. Because session cookies can grant account access, omitting privacy and credential-handling warnings increases the risk of credential exposure, accidental sharing, and misuse in scripts or repositories.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The FAQ explicitly describes using exported cookies to process Netflix content, which extends the tool’s use into authenticated paid-streaming scenarios without any warning about legal restrictions, terms-of-service issues, DRM limitations, or credential sensitivity. In a skill focused on bulk downloading/transcription, this guidance can normalize misuse of account-bound session tokens and encourage unauthorized access patterns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The FAQ discusses processing Netflix and other paid content with cookies but omits warnings about legal/access restrictions and the sensitivity of authentication material. In context, that makes the documentation more dangerous because it encourages users to operationalize access to paid platforms while underemphasizing both account-security and compliance risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script's description, help text, generated notes, and console messages are written in Chinese, and the generated note template also uses fixed Chinese section headers. There is no documented opt-in or locale selection for these user-visible outputs, which creates a language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script supports extracting browser cookies and saving downloaded media, transcripts, and metadata to disk, but it provides no explicit privacy warning, consent checkpoint, or guidance on handling sensitive authenticated content. In this skill context, that increases the chance users will process private or account-restricted media and leave sensitive artifacts on disk without understanding the exposure.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description promises '生成结构化学习笔记', suggesting substantive study-note generation. In practice, generate_notes mostly concatenates the full transcript, a simple first-20-segment timeline, and a placeholder '待人工整理核心观点、知识点和行动项', so the implemented behavior falls short of the described note-generation capability.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/batch_transcript.py (reported line 723)May include surrounding context.

python
# ffmpeg
    try:
        result = subprocess.run(['ffmpeg', '-version'], capture_output=True, text=True, timeout=5)
        if result.returncode == 0:
            print("✓ ffmpeg: 已安装")
        else:

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/check_env.py (reported line 25)May include surrounding context.

python
import_name = package_name
    
    try:
        __import__(import_name)
        print(f"✓ {package_name}: 已安装")
        return True
    except ImportError:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_env.py (reported line 35)May include surrounding context.

python
def check_command(cmd):
    """检查命令行工具是否可用"""
    try:
        result = subprocess.run(
            [cmd, '--version'],
            capture_output=True,
            text=True,

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill description emphasizes downloading, transcription, and note generation but does not disclose that media, transcripts, and derived notes will be written to local storage. This can expose sensitive content on shared systems or create unexpected retention of private/copyrighted material.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The README describes downloading media and generating transcripts, notes, and metadata on disk, but it does not clearly warn users that potentially large media files and sensitive derived content will be written locally. This can lead to unintentional retention of copyrighted, private, or confidential material in predictable directories where other local users or backup systems may access it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The usage examples write transcript outputs to local directories, and the optimization suggestions include direct Feishu document integration, but the document does not disclose data-handling implications. For a skill that processes media-derived content, users should be warned when outputs are stored locally or may later be sent to third-party services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.