Video Content Analyzer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:40 AM UTC
• Version: 1.1.0

Overview

The skill matches its video-analysis purpose, but it asks users to run broad local commands and can upload full transcripts and reports to external services without clearly requiring per-upload consent.

Install only if you are comfortable with command execution, video downloads, paid transcription, and sending video-derived content to OpenAI, search providers, Supabase, and Feishu. Use an isolated environment or pipx/venv for yt-dlp, avoid `--break-system-packages`, and review any transcript or report before uploading it to Supabase or Feishu.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:63

Finding

Unpinned Dependency Installation Bypasses System Package Protections

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:63-70
Vulnerability Type: Unpinned third-party dependency installed into the system Python environment
Risk Level: Medium

Vulnerable Code

bash

# Install yt-dlp (video download)
pip3 install --break-system-packages yt-dlp

# Install ffmpeg (audio processing)
# Mac: brew install ffmpeg
# Ubuntu: sudo apt install ffmpeg

Technical Analysis

The documented installation command retrieves yt-dlp from the package index without pinning an exact reviewed version or verifying an integrity hash. As a result, the installed code can change independently of this skill's review.

The --break-system-packages option also bypasses Python's externally managed environment protection. It permits pip to alter the host's system-level Python environment, potentially overwriting or introducing dependencies used by unrelated applications.

The audit found no evidence that yt-dlp is currently malicious and no intentional dependency-confusion package name was identified. The risk arises from unsafe dependency acquisition and installation practices: compromise of the package, its dependencies, an account, or the distribution channel could cause attacker-controlled installation or runtime code to execute.

Attack Path

1. An attacker compromises the published yt-dlp package, one of its transitive dependencies, a publisher account, or the package distribution channel.
2. A user follows the skill's documented pip3 install --break-system-packages yt-dlp command.
3. pip resolves and downloads the current uncontrolled package release without checking an expected version or cryptographic hash.
4. Package installation logic or subsequently imported executable code runs with the privileges of the user invoking pip3.
5. Because system-package protections were bypassed, malicious or incompatible files may affect the shared Python environment and applications that depend on it.

Impact Assessment

S ...[truncated 501 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --break-system-packages and install the dependency in an isolated environment, such as a dedicated virtual environment or pipx.
2. Pin yt-dlp to an exact reviewed version rather than resolving the latest release implicitly.
3. Use a lock file or requirements file with cryptographic hashes and install with hash enforcement, for example:

bash

python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.txt

4. Generate requirements.txt with an exact version and approved SHA-256 hashes for the package and all resolved dependencies.
5. Obtain packages only from a trusted, explicitly configured repository and consider using an internally mirrored and scanned package index.
6. Regularly scan and update the pinned dependency through a controlled review process.
7. Document that installation must not be performed with sudo or another privileged account.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest restricts the skill language to zh, which is a natural-language locale constraint. The file does not offer user opt-in or an alternative language choice, and it does not document a region-specific justification for enforcing Chinese only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill processes user-supplied video content and later sends transcripts, metadata, search-derived context, and possibly report content to external services such as OpenAI Whisper, Google Search, Supabase, and Feishu. Failing to clearly disclose these outbound transfers can cause inadvertent sharing of copyrighted, sensitive, or personal data without informed user consent.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

安装 ffmpeg (音频处理)

Mac: brew install ffmpeg

Ubuntu: sudo apt install ffmpeg

text

### API Key

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This example posts full video metadata and potentially complete transcripts to Supabase over the network, which is an external transmission of user-derived content. In this skill's context, transcripts and metadata can contain personal data, confidential material, or copyrighted text, so automatic upload increases privacy and data-governance risk if done without minimization and consent.

Content

Scanner excerpt · SKILL.md (reported line 406)May include surrounding context.

bash

# 使用 Supabase REST API 写入元数据
curl -s -X POST "${SUPABASE_URL}/rest/v1/video_analyses" \
  -H "apikey: ${SUPABASE_ANON_KEY}" \
  -H "Authorization: Bearer ${SUPABASE_ANON_KEY}" \
  -H "Content-Type: application/json" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The Feishu Wiki write flow transmits analysis results and source links to an external SaaS platform. If the generated report includes transcript excerpts, private video details, or search-enriched background data, publishing it externally can leak sensitive or regulated content beyond the local environment.

Content

Scanner excerpt · SKILL.md (reported line 455)May include surrounding context.

bash

# 正确：写入带链接的引用来源
curl -s -X POST \
  "https://open.feishu.cn/open-apis/docx/v1/documents/${OBJ_TOKEN}/blocks/${OBJ_TOKEN}/children" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \

Static analysis

No suspicious patterns detected.