Video Translator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:45 AM UTC
• Version: 1.0.0

Overview

This video translation skill appears purpose-aligned overall, but it asks for broad command and file authority while giving vague and sometimes unsafe operating guidance.

Install only if you are comfortable giving the agent broad file and command authority for media work. Process non-sensitive videos, avoid administrator elevation, keep API keys in environment variables, and require explicit confirmation before uploading media or running local commands.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:23

Finding

Excessive Execution Privileges and Unsafe Elevation Guidance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–26; supporting guidance at lines 214, 226, and 265
Vulnerability Type: Excessive tool permissions and privilege-escalation guidance
Risk Level: Medium

Vulnerable Code Snippet

yaml

tools:
- read
- exec
- write

The skill also states that it can execute system commands and recommends running with administrator privileges when permissions are insufficient:

text

Command execution: execute system commands in a secure sandbox and collect results.
If permissions are insufficient, check file permissions and run as administrator.

Technical Analysis

The skill requests general-purpose read, write, and exec capabilities, although the package contains no implementation, executable script, defined command allowlist, or concrete processing workflow demonstrating why unrestricted command execution is necessary.

The declared functionality concerns video translation, dubbing, and subtitle generation. These operations may legitimately require media-processing capabilities, but the skill does not constrain command execution to a specific binary, fixed argument schema, workspace, or set of approved input and output paths. Consequently, the permission model is broader than the documented task establishes.

The generic recommendation to run as administrator further weakens least-privilege boundaries. It treats elevation as a troubleshooting measure without identifying the exact resource that requires access or limiting the duration and scope of elevated privileges. Although the document advises against concatenating user input into commands, this control exists only as descriptive guidance and is not enforced by any implementation.

Attack Path

1. An agent loads the skill and grants its declared read, write, and exec tools.
2. A user supplies a video path, URL, filename, language option, or other media-processing input.
3. Because the skill defines no concrete imple ...[truncated 1571 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec unless a concrete and documented media-processing implementation requires it.
2. Replace general-purpose execution with narrowly scoped media-processing tools or APIs.
3. If command execution is unavoidable, define an explicit allowlist of permitted executables and subcommands.
4. Pass user-controlled values through structured argument arrays rather than shell command strings.
5. Reject shell metacharacters and validate language codes, paths, URLs, extensions, and file types against strict allowlists.
6. Restrict file reads and writes to a dedicated workspace using canonical-path checks that prevent traversal and symlink escapes.
7. Run processing under a dedicated unprivileged account with minimal filesystem and network permissions.
8. Remove all generic advice to run as administrator. Document the exact minimum file or directory permission required instead.
9. Enforce time, CPU, memory, output-size, and subprocess limits for media operations.
10. Implement sandboxing as a technical control rather than relying on descriptive claims in SKILL.md.
11. Document the exact external API endpoint and data-handling policy before permitting video uploads or network access.
12. Add tests confirming that attacker-controlled filenames, paths, URLs, and language parameters cannot alter command structure or access files outside the approved workspace.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises itself for broad 'video processing, audio editing, media conversion, dubbing generation' use cases while exposing read, write, and exec capabilities. That overly broad activation scope can cause the agent to invoke this skill in contexts beyond simple translation, increasing the chance of unnecessary command execution, handling of sensitive local files, or use on risky media-processing tasks without tighter guardrails.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The surrounding documentation describes a video translation/dubbing skill that should return translated subtitles, dubbed audio, or processed video artifacts, but the declared JSON output is a code-review style scoring report with fields like "overall_grade", "total_score", and "代码风格". This is an active contradiction in the skill documentation, not merely missing detail, and indicates the documented intent does not align with the claimed behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill accepts user-provided video files or URLs and discusses API-key-based external service use, but it does not prominently warn at the start that videos may be transmitted to third-party APIs. In a media skill, this is more dangerous because videos often contain faces, voices, documents, location data, or other sensitive content, so users may unknowingly exfiltrate private data off-platform.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.