在线视频转文字稿

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:03 PM UTC
• Version: 1.0.1

Overview

The skill is coherent for video transcript extraction, but its instructions expose users to review-worthy command-injection and supply-chain risks.

Review before installing. Use it only for public or non-sensitive video links, and prefer a revised version that passes URLs, titles, and transcript text as structured process arguments or stdin rather than interpolated shell text. Pin dependencies and add a lockfile before relying on it in a sensitive environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:55

Finding

Command Injection Through Untrusted URL, Video Metadata, and Subtitle Content

Content

View full analysis

" ``` ```powershell # SKILL.md:108-126 # Original node "~/.agents/skills/video-transcript/scripts/make_docx.js" "$tmp\transcript_original.docx" " - Original" "" # Chinese translation node "~/.agents/skills/video-transcript/scripts/make_docx.js" "$tmp\transcript_zh.docx" " - 中文译稿" "" ``` The alternative workflow still interpolates an untrusted title: ```powershell $plain | Out-File -Encoding utf8 "$tmp\content.txt" Get-Content "$tmp\content.txt" -Raw | node "~/.agents/skills/video-transcript/scripts/make_docx.js" "$tmp\transcript_original.docx" "" ``` ### Technical Analysis The documented workflow places user-controlled or remotely controlled values directly into PowerShell command text: - The video URL comes from the user. - The title may come from remote video metadata. - The original transcript can come from remotely hosted subtitles. - The translated transcript is derived from that untrusted subtitle content. Surrounding a substituted value with double quotes is not sufficient when the value itself can contain quotation marks, PowerShell statement separators, subexpressions, or other shell metacharacters. If the agent constructs a textual command by replacing placeholders such as `<URL>`, `<VideoTitle>`, or `<plain_text>`, a malicious value can terminate its quoted argument and introduce additional PowerShell syntax. The stdin-based variant avoids placing the transcript body in an argument, but it continues to place the video title directly into the command. It therefo ...[truncated 1349 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/package.json:13

Finding

Unpinned and Unlocked Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This is a clear description/behavior mismatch. The description promises a workflow that accepts video links and extracts spoken content/subtitles, but the code shown has no logic for URLs, downloading videos, calling yt-dlp, fetching subtitles, speech-to-text, or processing media in any way. Its sole behavior is converting existing plain text into a .docx file. While producing a .docx is consistent with part of the declared output format, the central advertised capability—getting transcript text from video sources—is absent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose describes an end-to-end video transcript extraction workflow from URLs, including support for multiple platforms and delivery as .docx documents. The actual code chunk does not access URLs, download videos or subtitles, invoke yt-dlp, or create Word documents. Its sole function is to parse an already-existing SRT subtitle file into plain text. This is materially narrower and different from the declared primary purpose, so it is a mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger scope is broad enough that users pasting a video URL and asking generally for text content could invoke networked retrieval and local file-generation actions without clear confirmation. In this context, that increases the chance of unintended external requests, processing of sensitive/private links, or accidental execution of heavyweight toolchains.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill sends user-supplied video URLs to yt-dlp and the target platform, but the description does not clearly warn users that their link and retrieval metadata will be disclosed to external services. This is dangerous because users may provide private, unlisted, internal, or sensitive URLs assuming the action is local-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Automatically translating all non-Chinese transcripts into Chinese without opt-in can expose content to additional model processing and produce outputs the user did not request. While not severe on its own, it can create unnecessary data handling and privacy risk, especially for sensitive or copyrighted material.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The dependency version is specified with a caret range (^9.6.1), which permits automatic installation of newer compatible releases. This creates supply-chain risk because builds are not fully reproducible and a compromised or regressed upstream release could be pulled in without an intentional review.

Content

Scanner excerpt · scripts/package.json (reported line 14)May include surrounding context.

json

"license": "ISC",
  "type": "commonjs",
  "dependencies": {
    "docx": "^9.6.1"
  }
}

Static analysis

No suspicious patterns detected.