video-understand

• Outcome: Review
• Latest audit: Aug 10, 2026 · 6:14 AM UTC
• Version: 1.0.6

Overview

The skill’s stated video-understanding workflow is mostly local and coherent, but the package also includes under-disclosed rendering code that can create final video outputs and mark a project render as verified.

Install only if you are comfortable with this skill package using local ffmpeg/Python workflows inside video project folders and with bundled render helpers being available. Keep projects in a dedicated workspace, review any render plan before running render_project.py, and avoid granting broad filesystem access beyond the intended project directory.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

plan_dir = plan_dir or Path(project_root) / "work" / "render"
    command, cwd, output = _build(plan, project_root, plan_dir)
    output.parent.mkdir(parents=True, exist_ok=True)
    subprocess.run(command, cwd=cwd, check=True)
    timeline = _load(_resolve(project_root, plan_dir, plan["timeline"]))
    source = _resolve(project_root, plan_dir, plan["source"])
    _verify_delivery(output, timeline, source)

• Confidence: 89% confidence
• Finding: This code executes ffmpeg on a command assembled from plan-controlled content, including filter graph segments taken directly from contribution fields such as audio-filter.filter and look.chain. Although shell injection is avoided by passing an argument list, ffmpeg itself interprets attacker-controlled filter syntax and can access files/protocol features, making this an unsafe sink for untrusted plan data in a skill whose declared scope is only understanding/analysis.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes shell commands and performs file reads/writes, but it declares no permissions or execution boundaries. In an agent environment, this creates an authorization gap: downstream systems or reviewers may assume the skill is non-privileged while it can mutate project files and execute external tools such as ffmpeg and Python scripts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documented purpose is limited to understanding and transcription, but the detected behavior includes broader project mutation and even rendering-related actions. This mismatch is dangerous because users or orchestration layers may invoke the skill under a low-risk assumption, while it can alter project state, generate outputs, and potentially trigger expensive or destructive operations beyond semantic analysis.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata says this capability is for reusable metadata, transcription, speech analysis, and semantic understanding before optional editing skills run, but this script performs full media rendering, writes a delivery report, and mutates project state to mark render status as verified. That scope mismatch is dangerous because it grants destructive/output-generating behavior to a supposedly analysis-only skill, increasing the chance that an agent can be induced to alter project artifacts or bypass workflow separation.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The module docstring advertises a narrow rendering purpose, but the implementation also writes reports and updates project metadata/status. Misleading documentation around side effects can cause operators or orchestrators to grant trust or invoke the script under false assumptions, which is especially risky in agentic systems where tool descriptions drive permission decisions.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/projectlib.py:1124