Video Transition

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:25 AM UTC
• Version: 1.0.0

Overview

This video-transition skill does what it claims, but its fallback video merge path handles temporary files and paths unsafely enough to warrant review before installation.

Review this skill before installing if it may process untrusted videos, filenames, or output directories. It is not showing deception or exfiltration, but it should be run only on trusted local media and in a controlled output folder until the concat fallback uses a secure temporary file, escapes or rejects unsafe path characters, and validates transition and duration inputs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: video_transition.py:251

Finding

Predictable Temporary Manifest Enables File Clobbering and FFmpeg Concat-List Injection

Content

View full analysis

str: """简单合并视频（无转场）""" list_file = os.path.join(os.path.dirname(output_path), "video_list.txt") with open(list_file, 'w', encoding='utf-8') as f: for path in video_paths: f.write(f"file '{os.path.abspath(path)}'\n") cmd = [ "ffmpeg", "-y", "-f", "concat", "-safe", "0", "-i", list_file, "-c:v", "libx264", "-c:a", "aac", output_path ] subprocess.run(cmd, check=True, capture_output=True, encoding='utf-8', errors='replace') os.remove(list_file) return output_path ``` ### Technical Analysis The fallback concatenation routine creates its manifest using the fixed filename `video_list.txt` in the output directory. It opens that path with overwrite semantics without verifying whether it already exists or is a symbolic link. If an attacker can modify the selected output directory, they can create `video_list.txt` as a symbolic link to another file writable by the process. Opening the manifest then follows the link and truncates or overwrites the target. The final `os.remove()` removes the manifest path or symbolic link, while the linked target remains corrupted. The routine also embeds absolute input paths directly into FFmpeg concat-demuxer syntax: ```python f.write(f"file '{os.path.abspath(path)}'\n") ``` Single quotes and line breaks in a supplied filename are not escaped or rejected. A crafted path can therefore terminate the intended `file` directive and add further concat-manifest directives. The use of `-safe 0` disables FFmpeg's safe-path restrictions, increasing the range of paths the injected manifest can reference. The issue is reachable directly through `concat_sim ...[truncated 2074 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill documentation advertises functionality that inherently requires shell execution and writing output files via ffmpeg, but it does not declare any tool scope such as allowed-tools or permissions. This creates a mismatch between documented capabilities and declared constraints, which can lead an agent runtime to invoke broader tools than users or reviewers expect, increasing the chance of unsafe command execution or filesystem modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list includes generic phrases such as "转场效果", "视频合并", and "淡入淡出", which are broad enough to overlap with ordinary user requests about video editing rather than uniquely identifying this skill. The file also provides no exclusion conditions or negative examples to clarify when the skill should not activate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module description and all user-facing strings are written in Chinese, which imposes a specific language/locale without any opt-in or documented justification. Under the stated policy, language constraints should be optional or clearly justified rather than silently enforced.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · video_transition.py (reported line 56)May include surrounding context.

python

"-of", "default=noprint_wrappers=1:nokey=1",
        video_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    try:
        return float(result.stdout.strip())
    except:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · video_transition.py (reported line 71)May include surrounding context.

python

"-of", "default=noprint_wrappers=1:nokey=1",
        video_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    try:
        return float(result.stdout.strip())
    except:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · video_transition.py (reported line 108)May include surrounding context.

python

output_path
    ]
    
    subprocess.run(cmd, check=True, capture_output=True, encoding='utf-8', errors='replace')
    return output_path

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 71% confidence

Finding

Although subprocess is invoked without a shell, the code interpolates untrusted values such as transition, duration, and offset into ffmpeg's filter graph string. If an attacker can control these values, they may be able to break filter syntax, trigger unintended ffmpeg behavior, or cause denial of service through malformed or extreme filter parameters; the skill context lowers this from RCE to a media-processing abuse risk, but it is still a real injection surface into a complex parser.

Content

Scanner excerpt · video_transition.py (reported line 160)May include surrounding context.

python

output
    ]
    
    result = subprocess.run(cmd, capture_output=True, text=True, encoding='utf-8', errors='replace')
    
    if result.returncode != 0:
        raise RuntimeError(f"转场失败: {result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

This command embeds a dynamically built filter_complex string derived from input-dependent transition names and timing values across multiple clips. While there is no shell injection, ffmpeg filter-graph injection into a permissive multimedia parser can lead to command failure, denial of service, or unintended processing behavior if an attacker supplies crafted transition lists or pathological durations.

Content

Scanner excerpt · video_transition.py (reported line 260)May include surrounding context.

python

print(f"转场时长: {transition_duration}s")
    print(f"转场效果: {len(set(transitions[:len(video_paths)-1]))} 种")
    
    result = subprocess.run(cmd, capture_output=True, text=True, encoding='utf-8', errors='replace')
    
    if result.returncode != 0:
        print(f"xfade 失败: {result.stderr[:500]}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 78% confidence

Finding

The concat helper writes a list file in ffmpeg concat-demuxer format using raw file paths inside single quotes, without escaping embedded quotes or special characters. A crafted filename containing a quote or newline can alter the list file semantics, potentially causing unintended files to be processed or making ffmpeg consume attacker-chosen paths; in a file-processing skill this is a realistic input-manipulation issue.

Content

Scanner excerpt · video_transition.py (reported line 286)May include surrounding context.

python

output_path
    ]
    
    subprocess.run(cmd, check=True, capture_output=True, encoding='utf-8', errors='replace')
    os.remove(list_file)
    return output_path

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description and most operational guidance are written in Chinese, and the trigger list is also Chinese-centric except for one technical keyword. The file does not state that the skill is region-specific or offer an explicit language/locale choice, which can conflict with language-neutral organizational policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python file contains natural-language strings and comments entirely in Chinese, including the module docstring and runtime print output. Under the policy rule, forcing a specific language without user opt-in can be a locale-policy violation when no alternative or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The package metadata uses Chinese-only natural-language description and keywords, which implies a fixed language/locale presentation without any opt-in or alternative. Under the stated policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The function writes a temporary video_list.txt file to disk and later deletes it, but there is no user-facing prompt or warning that the skill will create and remove an extra file in the output directory. This is a file-system side effect that may matter to users, especially if deletion fails and the temporary file is left behind.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.