Auto Subtitle

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:20 PM UTC
• Version:
  1.0.0

Overview

This subtitle tool appears purpose-built, but users should know it uploads extracted video audio to OpenAI and writes local subtitle, backup, and log files.

Install only if you are comfortable sending audio from selected videos to OpenAI and using your OpenAI API quota. Run preview first, process only intended folders, and be aware that existing subtitle files may be overwritten after being backed up in a relative backup directory.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documentation declares runtime requirements and clearly implies capabilities to read local videos, write subtitle and backup files, access environment variables, and invoke tooling such as ffmpeg, but it does not declare corresponding permissions. This creates a transparency and policy gap: users or platforms may underestimate what the skill can access and execute, increasing the risk of unintended file access or shell execution in a local environment.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill sends extracted audio content to the external OpenAI API, but the metadata does not clearly disclose this outbound data transfer. For a subtitle tool, users may reasonably expect fully local processing, so undisclosed transmission of potentially sensitive audio is a privacy and trust issue.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill processes local video files and uses the OpenAI Whisper API for transcription/translation, which means audio derived from local content is sent to a remote third-party service. Without a prominent warning, users may unknowingly upload sensitive conversations, copyrighted media, or personal data, creating privacy, compliance, and data-handling risks.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Audio extracted from user videos is transmitted to a third-party API without a clear runtime warning or consent step. Videos may contain sensitive speech, so silent exfiltration to an external service creates a meaningful privacy risk even if the feature is intended.

VirusTotal

66/66 vendors flagged this skill as clean.