video-audio-replace

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:09 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it says, but it needs review because it encourages unsafe privileged package installation and can send subtitle text to third-party TTS services without a clear privacy warning.

Review before installing. Use an isolated virtual environment with pinned dependencies, do not follow the sudo pip3 --break-system-packages instruction, avoid running this as root, and only use ElevenLabs or Edge TTS with subtitle text you are comfortable sending to those providers. Be cautious on shared machines because the tool uses predictable temporary paths under /tmp.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: generate_subtitles.py:14

Finding

Unpinned dependencies and unsafe privileged installation guidance

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: replace.py:121

Finding

Predictable shared temporary files permit symlink attacks and cross-process interference

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code chunk implements only the subtitle-generation portion of the declared description. It loads a Whisper model, transcribes the input video, formats segment timestamps, and outputs an .srt file. It does not perform the skill's primary declared behavior of replacing video audio with synthesized speech, nor does it call ElevenLabs or Edge TTS, modify video/audio tracks, align generated speech to the original audio timing in the described way, adjust speed, or insert silence. Because the declared purpose presents a broader dubbing/TTS pipeline while this code only handles subtitle generation, the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Most of the declared audio-replacement behavior is accurately represented: the script takes a video and subtitle file, generates TTS with ElevenLabs or Edge, aligns each segment to subtitle timestamps, adjusts speed using ffmpeg atempo with a user-supplied range, adds silence, concatenates segments, and muxes the new audio into the video. However, the description also claims 'Includes subtitle generation from video using Whisper,' which is a material declared capability not implemented here. The script requires --srt as an input and contains no Whisper import, transcription logic, or subtitle extraction from the video. This is a description-behavior mismatch due to a missing declared feature, though there are no obvious undeclared unrelated or malicious capabilities.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documents capabilities that imply shell execution, file reads/writes, environment-variable access, and network use, but it does not declare any tool scope or permission boundaries. In an agent environment, that omission weakens least-privilege controls and can allow broader-than-expected access when processing user-supplied video, subtitles, and API credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages use of ElevenLabs or Edge TTS without clearly warning that subtitle text derived from the user's video may be transmitted to third-party services. Because subtitles can contain sensitive spoken content, users may unknowingly disclose private, proprietary, or regulated information to external providers.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · generate_subtitles.py (reported line 16)May include surrounding context.

python

from faster_whisper import WhisperModel
except ImportError:
    print("Error: faster-whisper not installed.")
    print("Install with: sudo pip3 install faster-whisper --break-system-packages")
    sys.exit(1)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description says it includes subtitle generation from video using Whisper, which implies code that transcribes the video audio into subtitles. In this file, the CLI requires an existing --srt input and there is no Whisper import, invocation, or transcription logic anywhere; the implementation only replaces audio based on provided subtitles.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · replace.py (reported line 40)May include surrounding context.

python

def get_duration(filepath):
    """Get audio/video duration in seconds"""
    result = subprocess.run(
        ["ffprobe", "-v", "error", "-show_entries", "format=duration",
         "-of", "default=noprint_wrappers=1:nokey=1", filepath],
        capture_output=True, text=True

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Subtitle text is transmitted to a third-party TTS provider, which may contain sensitive or copyrighted content, without any prominent warning, consent flow, or privacy guardrails. In a media-processing skill, users may reasonably expect local transformation unless cloud transmission is made explicit, so the context increases the privacy risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The hardcoded ElevenLabs endpoint confirms that this tool relies on a third-party service for some processing, which creates a privacy and data-governance risk when handling subtitle text. The danger is contextual rather than malicious: users may unknowingly send content off-device.

Content

Scanner excerpt · replace.py (reported line 50)May include surrounding context.

python

def generate_elevenlabs(text, output_path, voice_id, api_key):
    """Generate audio using ElevenLabs API"""
    url = f"https://api.elevenlabs.io/v1/text-to-speech/{voice_id}"
    headers = {
        "Accept": "audio/mpeg",
        "Content-Type": "application/json",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This code sends subtitle contents to an external API over the network, which is a real data-exposure event. While this is part of the feature, it becomes security-relevant because the transmitted text may include sensitive content and the skill does not appear to enforce explicit consent or minimization.

Content

Scanner excerpt · replace.py (reported line 62)May include surrounding context.

python

"voice_settings": {"stability": 0.5, "similarity_boost": 0.75}
    }

    response = requests.post(url, json=data, headers=headers)
    if response.status_code == 200:
        with open(output_path, 'wb') as f:
            f.write(response.content)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · replace.py (reported line 90)May include surrounding context.

python

def extract_original_audio(video_file, output_file):
    """Extract audio from video"""
    subprocess.run([
        "ffmpeg", "-y", "-i", video_file, "-vn", "-acodec", "mp3",
        "-ar", "44100", "-ac", "1", output_file
    ], capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · replace.py (reported line 98)May include surrounding context.

python

def split_audio(audio_file, start_time, duration, output_file):
    """Split audio file from start_time for duration"""
    subprocess.run([
        "ffmpeg", "-y", "-i", audio_file, "-ss", str(start_time),
        "-t", str(duration), "-vn", "-acodec", "mp3", output_file
    ], capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · replace.py (reported line 106)May include surrounding context.

python

def adjust_speed(input_file, output_file, speed_ratio):
    """Adjust audio speed using atempo"""
    subprocess.run([
        "ffmpeg", "-y", "-i", input_file, "-filter:a", f"atempo={speed_ratio}",
        "-vn", output_file
    ], capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · replace.py (reported line 114)May include surrounding context.

python

def add_silence(duration, output_file):
    """Generate silence audio"""
    subprocess.run([
        "ffmpeg", "-y", "-f", "lavfi", "-i", f"anullsrc=r=44100:cl=mono",
        "-t", str(duration), "-q:a", "9", output_file
    ], capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 76% confidence

Finding

The concat list is written using raw file paths into ffmpeg's concat demuxer format with -safe 0, but paths are not escaped or validated. If an attacker can influence file names written into the list, specially crafted names containing quotes or concat directives could alter ffmpeg's interpretation, causing unintended file access or processing behavior.

Content

Scanner excerpt · replace.py (reported line 127)May include surrounding context.

python

for file in files:
            f.write(f"file '{file}'\n")

    subprocess.run([
        "ffmpeg", "-y", "-f", "concat", "-safe", "0", "-i", concat_list,
        "-c", "copy", output_file
    ], capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · replace.py (reported line 142)May include surrounding context.

python

silence_file = audio_file + ".silence.mp3"
    add_silence(silence_duration, silence_file)

    subprocess.run([
        "ffmpeg", "-y", "-i", audio_file, "-i", silence_file,
        "-filter_complex", "[0:a][1:a]concat=n=2:v=0:a=1[out]",
        "-map", "[out]", output_file

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · replace.py (reported line 152)May include surrounding context.

python

def replace_video_audio(video_file, audio_file, output_file):
    """Replace video audio with new audio"""
    subprocess.run([
        "ffmpeg", "-y", "-i", video_file, "-i", audio_file,
        "-c:v", "copy", "-c:a", "aac", "-b:a", "192k",
        "-map", "0:v:0", "-map", "1:a:0",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · replace.py (reported line 268)May include surrounding context.

python

silence_file = f"{temp_dir}/end_silence.mp3"
        add_silence(silence_needed, silence_file)

        subprocess.run([
            "ffmpeg", "-y", "-i", merged_audio, "-i", silence_file,
            "-filter_complex", "[0:a][1:a]concat=n=2:v=0:a=1[out]",
            "-map", "[out]", final_audio

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest focuses on replacing video audio and generating subtitles, but does not mention reading secrets from environment variables or credential-dependent operation. Accessing ELEVENLABS_API_KEY introduces a credential-handling capability beyond the core local media-processing purpose unless the manifest explicitly scopes external authenticated TTS use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.