Video Frames

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:14 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward FFmpeg helper for extracting video frames, with one input-validation weakness users should avoid exposing to untrusted values.

Install only if you are comfortable running FFmpeg on local video files. Prefer --time or use simple numeric --index values, and do not pass --index from untrusted or automatically generated input until the script validates it as a non-negative integer.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/frame.sh:62

Finding

Unvalidated Frame Index Permits FFmpeg Filtergraph Injection

Content

View full analysis

Vulnerability Details

File Location: scripts/frame.sh, lines 29-31 and 62-65
Vulnerability Type: FFmpeg filtergraph injection through unvalidated input
Risk Level: Medium

Vulnerable Code

bash

    --index)
      index="${2:-}"
      shift 2
      ;;

bash

if [[ "$index" != "" ]]; then
  ffmpeg -hide_banner -loglevel error -y \
    -i "$in" \
    -vf "select=eq(n\\,${index})" \
    -vframes 1 \
    "$out"

Technical Analysis

The value supplied through --index is copied into index without validating that it is a non-negative integer. It is then interpolated directly into the argument passed to FFmpeg's -vf option.

Shell quoting prevents the value from being interpreted as shell syntax, so this is not direct shell-command injection. However, the quoted value is still parsed by FFmpeg as filtergraph syntax. An attacker can supply FFmpeg expression delimiters, commas, parentheses, option assignments, or additional filter names rather than an integer. By balancing the final parenthesis appended by the script, a crafted value can modify the intended select expression or append filters supported by the installed FFmpeg build.

Attack Path

1. An attacker gains control of the value passed to frame.sh --index, such as through an agent-generated invocation based on untrusted user input.
2. The script accepts the value without checking its format.
3. The value is inserted into select=eq(n\,${index}).
4. FFmpeg parses the resulting string as a filtergraph rather than treating the entire value as an integer.
5. Injected filters execute inside the FFmpeg process with the permissions and resource access of the user running the Skill.

For example, a value structured like 0),FILTER=EXPRESSION( can close the intended expression and introduce another filter while using the script's final parenthesis to complete the injected syntax. The exact usable filters and gramma ...[truncated 642 chars]

Remediation

View remediation

Remediation Suggestions

Validate --index before constructing the FFmpeg filter and reject every value that is not composed exclusively of decimal digits:

bash

if [[ -n "$index" && ! "$index" =~ ^[0-9]+$ ]]; then
  echo "Invalid --index: expected a non-negative integer" >&2
  exit 2
fi

Apply the validation immediately after argument parsing and before creating directories or invoking FFmpeg. Consider additionally enforcing a reasonable maximum index to limit unexpectedly expensive decoding:

bash

max_index=1000000

if [[ -n "$index" ]]; then
  if [[ ! "$index" =~ ^[0-9]+$ ]] || (( 10#$index > max_index )); then
    echo "Invalid --index: expected an integer from 0 to $max_index" >&2
    exit 2
  fi
fi

The security boundary must be syntactic validation rather than shell quoting, because FFmpeg independently parses the -vf argument after shell processing. Add regression tests covering letters, negative values, commas, parentheses, backslashes, filter names, empty values, and excessively large integers.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.