Video Post Production

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:30 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent video-editing helper, but it needs Review because weak path validation can let crafted production plans pull audio from outside the chosen SFX folder and the install/runtime steps are under-scoped.

Install only if you trust the production_plan.json source and are comfortable running FFmpeg and Python media tooling locally. Use a virtual environment with pinned dependencies, keep inputs and outputs in a dedicated workspace, avoid arbitrary SFX type values, and review generated subtitles and output paths before publishing or overwriting files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:68

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/render_video.py:27

Finding

SFX Path Traversal Allows Access Outside the Authorized Asset Directory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_subtitles.py:73

Finding

ASS Control Syntax Injection Through Unescaped Subtitle Plan Data

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a full short-video post-production pipeline, including subtitle phrasing, keyword highlighting, SFX, BGM, and final polished video rendering. The supplied code chunk is a narrow preprocessing/transcription utility: it checks ffmpeg dependencies, extracts mono WAV audio, transcribes with faster-whisper using word timestamps, captures segment and word timing, and writes JSON. This is only one sub-step of the declared workflow (speech transcription/alignment). There is no code for subtitle styling/compositing, effects/music logic, video editing, or final render output. Therefore the description materially overstates the implemented behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a full post-production pipeline for short-form video editing, starting from a raw talking-head video and ending with a finished video including subtitles, SFX, and BGM. The supplied code does not perform those end-to-end tasks. It only reads a JSON plan and generates an ASS subtitle script with styling, line wrapping, fade, and highlighted words. While subtitle generation and keyword highlighting are consistent with part of the description, the primary purpose is much narrower than declared, and several major claimed capabilities are absent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes shell commands, reads local resources, and writes output files, but it does not declare any tool scope or execution permissions. This creates an authorization and review gap: an agent may execute filesystem and shell operations more broadly than users or platform policy expect, increasing the chance of unintended command execution or file modification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow hard-codes --language "zh", which imposes a specific language/locale choice. The file does not state that the skill is only for Chinese-language videos or offer the user a language selection, so this is a natural-language policy concern.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/align_speech.py (reported line 21)May include surrounding context.

python

"ffprobe", "-v", "error", "-show_entries", "format=duration",
            "-of", "default=noprint_wrappers=1:nokey=1", video_path
        ]
        output = subprocess.check_output(cmd, stderr=subprocess.PIPE).decode("utf-8").strip()
        return float(output)
    except Exception as e:
        print_err(f"Warning: Could not get video duration via ffprobe: {e}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/align_speech.py (reported line 35)May include surrounding context.

python

"ffmpeg", "-i", video_path, "-vn", "-acodec", "pcm_s16le",
            "-ar", "16000", "-ac", "1", "-y", audio_path
        ]
        result = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        if result.returncode != 0:
            print_err(f"Error: ffmpeg extraction failed with exit code {result.returncode}")
            print_err(result.stderr.decode())

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/align_speech.py (reported line 49)May include surrounding context.

python

"""Check if ffmpeg and ffprobe are available."""
    for cmd in ["ffmpeg", "ffprobe"]:
        try:
            subprocess.run([cmd, "-version"], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        except FileNotFoundError:
            print_err(f"Error: '{cmd}' is not installed or not in PATH.")
            return False

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_video.py (reported line 15)May include surrounding context.

python

"-show_entries", "format=duration:stream=codec_type,width,height",
        "-of", "json", input_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        raise Exception(f"ffprobe failed: {result.stderr}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_video.py (reported line 101)May include surrounding context.

python

"-show_entries", "stream_side_data=rotation",
            "-of", "csv=p=0", args.input
        ]
        rot_result = subprocess.run(rot_cmd, capture_output=True, text=True)
        rot_str = rot_result.stdout.strip()
        if rot_str:
            rotation = int(float(rot_str))

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script unconditionally passes -y to ffmpeg, causing the output path to be overwritten without confirmation. In an agent context where output paths may be generated or influenced automatically, this can destroy existing user files or clobber important artifacts, especially if a sensitive or unexpected path is supplied.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_video.py (reported line 241)May include surrounding context.

python

print("Executing FFmpeg...")
    try:
        process = subprocess.Popen(
            ffmpeg_cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.STDOUT,

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs creating a sibling output directory and writing multiple files near the user-supplied video path without warning about side effects, path safety, or overwrite behavior. In practice this can lead to unintended modification of sensitive locations, clutter in shared directories, or destructive overwrites if filenames collide or if the input path points to an unexpected mount or workspace.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file contains substantive instructions and operational guidance primarily in Chinese, but it does not indicate that the skill is Chinese-only or provide any user opt-in for language/locale. That can violate a language-choice policy when users may reasonably expect neutral or selectable language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script sets --language to zh by default, which imposes a specific language/locale behavior unless the user explicitly overrides it. This is a natural-language policy concern because the tool defaults to one language rather than offering neutral auto-detection or requiring user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.