Security audit
Security checks for vulnerabilities and agentic risk
This is a local ffmpeg video-frame extraction skill with some documentation quality issues, but no hidden execution, exfiltration, persistence, or purpose-incompatible behavior was found.
Install only if you want a Chinese-language, local ffmpeg-based helper for extracting still frames from videos. Review commands before running them, especially package installation with sudo, and avoid treating it as an audio-editing, dubbing, transcoding, or cloud-processing tool despite the overbroad trigger text.
The trigger text says to use the skill when 'video processing, audio editing, media conversion, dubbing generation' are needed, but the skill only supports local video frame extraction. Terms like audio editing, media conversion, and dubbing generation are broad, common task categories that could cause the agent to invoke this skill for unrelated requests.
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
brew install ffmpeg
# ...
# Ubuntu / Debian
sudo apt update && sudo apt install ffmpeg
# ...
# CentOS / RHEL
sudo yum install epel-release && sudo yum install ffmpeg
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
brew install ffmpeg
# ...
# Ubuntu / Debian
sudo apt update && sudo apt install ffmpeg
# ...
# CentOS / RHEL
sudo yum install epel-release && sudo yum install ffmpeg
The skill’s user-facing display name and descriptive content are presented in Chinese, and the document continues entirely in Chinese, with no indication that users may choose another language. This can violate language/locale policy when a skill imposes a specific language without user opt-in or a documented region-specific constraint.
The manifest repeatedly frames the skill as a fully local ffmpeg-based tool with no cloud upload and no direct URL support, and explicitly says the free edition only supports local video files. However, the documented input includes a callback_url for asynchronous notification, and later error handling discusses network connectivity. This creates a documentation-level contradiction about whether network interaction is part of the skill's behavior.
The skill is consistently described elsewhere as a lightweight video frame extraction tool, limited to single-frame capture, first-frame preview, format switching, and basic thumbnail generation. The trigger condition says it should be used for '音频编辑、媒体转换、配音生成', which directly contradicts the declared scope and would mislead an agent about the intended use of this skill.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- **Windows**：`winget install ffmpeg` 或下载官方压缩包
- **macOS**：`brew install ffmpeg`
- **Linux（Ubuntu/Debian）**：`sudo apt install ffmpeg`
### Q2：抓取的画面是黑屏？
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- **Windows**：`winget install ffmpeg` 或下载官方压缩包
- **macOS**：`brew install ffmpeg`
- **Linux（Ubuntu/Debian）**：`sudo apt install ffmpeg`
### Q2：抓取的画面是黑屏？
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
sudo apt update && sudo apt install ffmpeg
sudo yum install epel-release && sudo yum install ffmpeg
### API Key 配置
No suspicious patterns detected.