Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says, but it can overwrite original MKV files by default, including in batch use, and its CLI help understates that risk.
Review this carefully before installing. Use --dry-run first and pass --output to write side-by-side files instead of replacing originals. Avoid running it recursively or on a whole folder unless you have backups and have confirmed the exact files to process.
The skill clearly instructs use of shell commands and performs file read/write operations, yet it declares no explicit tool scope or permission boundary. In an agent setting, that omission increases the chance the skill can invoke filesystem and shell capabilities more broadly than intended, especially because it can overwrite source media files by default.
The trigger phrases are broad enough to match many generic subtitle or MKV requests, which can cause the skill to activate in contexts the user did not intend. Because this skill performs shell-backed media processing and may replace files, over-broad activation increases the risk of unintended execution on user files.
The skill notes that source MKV files are replaced by default, but the warning is easy to miss and appears after execution-oriented guidance. In practice this creates a real data-integrity risk: users may invoke the documented command path without understanding that the original file will be overwritten, leading to irreversible loss or corruption if processing fails or produces undesired output.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"""Parse mkvinfo output for subtitle tracks with full metadata."""
if not shutil.which('mkvinfo'):
return []
result = subprocess.run(
['mkvinfo', mkv_path],
capture_output=True, text=True
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def _get_tracks_from_mkvmerge(mkv_path):
"""Fallback: parse mkvmerge -i output."""
result = subprocess.run(
['mkvmerge', '-i', mkv_path],
capture_output=True, text=True
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def extract_subtitle(mkv_path, track_id, output_path):
"""Extract a subtitle track from MKV"""
result = subprocess.run(
['mkvextract', mkv_path, 'tracks', f'{track_id}:{output_path}'],
capture_output=True, text=True
)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.extend(['--default-track-flag', '0:0'])
cmd.append(sub_path)
result = subprocess.run(cmd, capture_output=True, text=True)
if result.returncode not in (0, 1): # 0=success, 1=warnings
print(f" ✗ mkvmerge failed: {result.stderr.strip()}", file=sys.stderr)
return False
The script performs destructive in-place replacement of the source MKV without an explicit warning or opt-in at the moment of replacement. In the context of a subtitle-merging automation skill, this elevates the risk of accidental bulk file modification and user surprise, which can lead to loss of original media or metadata if anything goes wrong during embedding.
When no output path is supplied, the script replaces the original MKV in place after generating a temporary output. In a user-facing skill, this is dangerous because it makes destructive modification the default behavior, increasing the chance of accidental data loss or irreversible corruption if the merge result is wrong or the replacement occurs contrary to user expectations.
The help text claims the default output is a new file ('input_bilingual.mkv'), but the actual code overwrites the input file when no output is specified. This mismatch is security-relevant because users may trust the safer documented behavior and unintentionally destroy originals, especially in a batch-processing media skill where many files may be modified at once.
No suspicious patterns detected.