Security audit

Media Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims as a media analyzer, but its output commands can silently overwrite existing files.

Install only if you are comfortable with a Chinese-language local media tool that reads the files or directories you point it at. Be careful when using frame, cover, or waveform commands because existing frame.jpg, cover.jpg, waveform.png, or any chosen output path may be overwritten without warning.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: media-analyzer.sh:72
Finding: JSON Injection Through Unescaped Media File Paths
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: media-analyzer.sh:94
Finding: Unconditional Overwrite of User-Selected Output Files
Content: View full analysis
/dev/null ``` ```bash # 提取视频封面 extract_cover() { local file="$1" local output="${2:-cover.jpg}" if [[ ! -f "$file" ]]; then echo "错误: 文件不存在: $file" exit 1 fi # 尝试从视频中提取嵌入的封面 ffmpeg -y -i "$file" -vcodec copy -an "$output" 2>/dev/null # 如果没有嵌入封面，提取第一帧 if [[ ! -s "$output" ]]; then ffmpeg -y -ss 00:00:01 -i "$file" -vframes 1 -q:v 2 "$output" 2>/dev/null fi ``` ```bash # 生成音频波形 generate_waveform() { local file="$1" local output="${2:-waveform.png}" if [[ ! -f "$file" ]]; then echo "错误: 文件不存在: $file" exit 1 fi ffmpeg -y -i "$file" -filter_complex "showwavespic=s=800x200:colors=#4A90D9" -frames:v 1 "$output" 2>/dev/null ``` ### Technical Analysis All three output-producing operations invoke `ffmpeg` with the `-y` option. This option unconditionally overwrites an existing destination without prompting or requiring explicit authorization. The default output names—`frame.jpg`, `cover.jpg`, and `waveform.png`—are predictable. The command also accepts an arbitrary output path from the caller and does not check whether that path already exists, whether it is a symbolic link, or whether it points outside an intended output directory. Consequently, invoking one of these operations can destroy an existing file writable by the process. If the tool runs in a shared or attacker-influenced directory, predictable output names also create an opportunity for pre-positioning a f ...[truncated 1379 chars]
Remediation: View remediation
&2 return 1 fi ``` 3. Add an explicit `--overwrite` option if replacement is required. Only that option should enable `-y`. 4. Restrict outputs to a designated directory where appropriate. Canonicalize and validate the destination before writing. 5. Reject symbolic-link destinations and account for race conditions between validation and file creation. 6. For automated operation, create a private output directory with restrictive permissions and generate unpredictable output names with `mktemp`. 7. Clearly document whether successful output creation is atomic and how partial files are handled when `ffmpeg` fails. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: A skill description written only in Chinese without an explicit locale constraint or alternate language guidance can cause operators or routing systems to misinterpret the skill's scope and behavior. That ambiguity can lead to accidental invocation, poor review quality, or misuse by users who cannot accurately understand prerequisites, limitations, or outputs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are broad enough to match common user intents such as generic 'content analysis' or 'video analysis', which can cause the skill to activate unexpectedly outside its narrow media-file context. This increases the risk of incorrect routing, unintended tool use, or the skill being selected for requests it is not appropriate to handle.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The frame, cover, and waveform functions invoke ffmpeg with the -y flag, which forcibly overwrites the user-supplied output path without prompting. In an agent or automation context, this can silently destroy existing files if the caller passes an important path or if defaults like frame.jpg/cover.jpg/waveform.png collide with existing files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: All natural-language help and status/error messages are presented only in Chinese, which imposes a specific language on users without opt-in or documented locale scope. The file does not indicate that the skill is intended only for a Chinese-language environment or provide any way to select another language.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.