video-understand

• Outcome: Review
• Latest audit: Oct 7, 2026 · 4:33 AM UTC
• Version: 1.0.7

Overview

The skill mainly describes video understanding, but it also ships under-disclosed editing and final-rendering code that can create output videos and update project state.

Review this before installing if you expect a read-oriented understanding skill. It can copy and analyze media, write project/review/final files, run ffmpeg/ffprobe and faster-whisper, and it also includes rendering/editing pipeline code that can produce a final video and mark render status verified. Use only in a project-specific workspace with trusted media and plans.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose focuses on media analysis capabilities such as metadata extraction, transcription, speech analysis, and semantic understanding. The supplied code does none of those things. Instead, it reads a project configuration, invokes a render-plan builder, and writes a render plan file for downstream rendering. That is a materially different primary purpose related to render pipeline preparation, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents an analysis/preprocessing skill focused on metadata, transcription, speech analysis, and semantic understanding. The actual code does none of those things. Instead, it transforms an existing edit plan into a canonical timeline format for editing/output purposes. This is a materially different primary purpose, indicating a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description is for a video-understanding skill that would analyze source media and produce metadata/transcripts/semantic evidence. The supplied code instead is a regression test script for project/render protocol behaviors. Although one check touches transcript mapping and fixture operations mention a 'video-understand' dependency, the script itself does not perform media understanding. Its main function is to create temporary project fixtures and assert correctness of validation, render-plan compilation, artifact hashing, evidence counts, dependency ordering, and related protocol rules. That is a materially different primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose centers on analysis capabilities: metadata extraction plus transcription, speech analysis, and semantic understanding. This code only performs setup for such later work. It creates directories, copies the input file, probes basic media facts, writes project/timeline JSON, and emits a summary explicitly saying transcript, semantic summary, and contact sheet are pending. While probing media metadata partially overlaps with the description, the primary behavior is project initialization, which is materially different from the declared understanding/analysis function.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code clearly implements only media probing/metadata extraction plus fingerprint generation. It does not perform transcription, speech analysis, semantic understanding, or any language/audio-content analysis. The declared description bundles several substantially broader capabilities that are not represented in this code chunk. While the 'reusable media metadata' portion matches, the overall description overstates the skill's behavior in material ways.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description presents this as a pre-editing analysis/metadata skill focused on reusable media metadata, word-level transcription, speech analysis, and semantic understanding. The code instead is a general shared project protocol/helper library for an editing system. Its dominant behavior is validating and compiling project structures, enforcing filesystem safety, locking project mutations, checking operation dependencies, building render plans, validating multiple downstream editing plans, and mapping transcripts onto timelines. While there is partial overlap—e.g., semantic-understanding validation and transcript-to-timeline support—the code does not actually generate transcription, metadata extraction, or speech analysis. More importantly, it contains substantial undeclared capabilities tied to editing workflow orchestration and delivery compilation, which materially broadens and changes the primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about analysis/preprocessing capabilities: metadata extraction, transcription, speech analysis, and semantic understanding before editing. The supplied code does none of those things. Its primary function is a render pipeline that compiles a delivery plan into a final encoded video, verifies the result, writes a delivery report, and updates project state. This is a materially different purpose and introduces undeclared capabilities related to media rendering/editing and filesystem/output mutation. Therefore the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents this skill as one that generates or provides media metadata, transcription, speech analysis, or semantic understanding artifacts. The supplied code does not perform any of those tasks. Instead, it only validates existing JSON inputs for project, timeline, and understanding data, including optional file/media checks for projects. This is a materially different primary purpose: verification of artifacts rather than creation or analysis of media-derived outputs. No evidence in the code supports transcription, speech analysis, metadata extraction, or semantic understanding generation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about upstream media understanding capabilities: metadata extraction, transcription, speech analysis, and semantic understanding. The actual code does none of that. Instead, it is test code focused on editor protocol correctness, stale dependency handling, timeline validation, caption overlay rendering behavior, and image-based bounds calculations. While captions are mentioned, the code is not generating transcripts or semantic analysis; it is validating how preexisting caption plans are expanded into render layers. This is a materially different primary purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description emphasizes analysis-oriented capabilities: metadata extraction, transcription, speech analysis, and semantic understanding. The supplied code does not implement or test any of those functions. Instead, it focuses on rendering and editing behaviors using ffmpeg, including constructing filter graphs, compositing overlays, inserting timeline assets, and verifying resulting audio/video output. This is a materially different primary purpose from the declared one, so the description does not accurately represent the code chunk's behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes this skill as providing reusable media metadata, transcription, speech analysis, and semantic understanding before optional editing skills run. This file implements build_render_plan and related validation for B-roll, captions, color grading, motion graphics, content cards, timeline edits, and final delivery outputs, which are editing/render orchestration behaviors rather than understanding-only analysis.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This script performs end-to-end media rendering with ffmpeg/ffprobe, including overlays, filters, inserts, output constraints, and final encoding, which is materially broader than the skill's stated understanding-only scope. In this context, the mismatch is security-relevant because it grants powerful file-processing and output-producing behavior to a skill that users or orchestrators may trust as read-oriented, increasing the blast radius of adversarial plans or media.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file writes a delivery report and updates project render status to "verified," which exceeds the declared purpose of reusable video understanding. In an agent-skill setting, this creates a capability-integrity problem: a supposedly analysis-only skill can mutate project state and attest success, enabling unauthorized workflow advancement or misleading downstream automation.

Content

No source excerpt is available for this finding.

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 95% confidence

Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · scripts/render_project.py (reported line 636)May include surrounding context.

python

def _write_delivery_report(output, project_root):
    result = subprocess.run(
        [
            "ffprobe", "-v", "error", "-show_entries",
            "stream=codec_type,width,height,duration:format=duration", "-of", "json", str(output),

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to read and write project files and invoke external shell commands such as ffmpeg, ffprobe, and Python scripts, but it declares no explicit tool scope or permission boundary. That increases the chance an orchestrator grants broader-than-necessary capabilities, enabling unintended file access or command execution if the skill is invoked on untrusted inputs or in the wrong directory.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/probe.py (reported line 22)May include surrounding context.

python

def probe(path):
    result = subprocess.run(
        [
            "ffprobe", "-v", "error", "-show_entries",
            "format=duration,format_name,bit_rate:stream=index,codec_type,codec_name,width,height,avg_frame_rate,r_frame_rate,pix_fmt,sample_rate,channels,color_range,color_space,color_transfer,color_primaries",

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The top-level docstring presents the file as generic shared project protocol helpers. In practice, the module contains substantial workflow-specific logic for validating B-roll reviews, caption rendering, motion graphics, content cards, and assembling final render plans, which is materially more than neutral protocol helpers.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description frames the capability as producing metadata, transcription, and semantic understanding, which implies analysis-oriented processing. This module includes generic JSON/file writes, project mutation leases, and START-HERE.md generation, introducing project state mutation and workflow-file authoring not justified by the stated understanding-focused purpose.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/projectlib.py (reported line 277)May include surrounding context.

python

errors.append("source fingerprint duration_s must be numeric")
    elif check_media:
        try:
            result = subprocess.run(
                [
                    "ffprobe", "-v", "error", "-show_entries", "format=duration",
                    "-of", "default=noprint_wrappers=1:nokey=1", str(path),

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

A video-understanding skill would not ordinarily need to import and execute code from a separate motion-graphics editing skill. Dynamically loading video-add-motion-graphics logic couples this skill to downstream editing capabilities that are outside the manifest's understanding-oriented context.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_project.py (reported line 46)May include surrounding context.

python

raise ValueError(
                f"source fingerprint {key} mismatch: expected {expected.get(key)}, current {current}"
            )
    result = subprocess.run(
        [
            "ffprobe", "-v", "error", "-show_entries", "format=duration",
            "-of", "default=noprint_wrappers=1:nokey=1", str(source),

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 83% confidence

Finding

The script builds a highly dynamic ffmpeg command from untrusted render-plan data, including filter chains and codec/output constraint fields, then executes it. Although shell injection is avoided by passing a list, ffmpeg itself is a powerful parser and processor of attacker-controlled media, filters, and options; in this skill context, invoking full rendering is more dangerous because the skill is supposed to perform video understanding, not editing or delivery generation.

Content

Scanner excerpt · scripts/render_project.py (reported line 575)May include surrounding context.

python

plan_dir = plan_dir or Path(project_root) / "work" / "render"
    command, cwd, output = _build(plan, project_root, plan_dir)
    output.parent.mkdir(parents=True, exist_ok=True)
    subprocess.run(command, cwd=cwd, check=True)
    timeline = _load(_resolve(project_root, plan_dir, plan["timeline"]))
    source = _resolve(project_root, plan_dir, plan["source"])
    expected_duration_s = _output_duration_s(timeline, plan.get("contributions", []))

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_project.py (reported line 584)May include surrounding context.

python

def _probe_delivery(path):
    result = subprocess.run(
        [
            "ffprobe", "-v", "error", "-show_entries",
            "stream=codec_type,width,height,duration:format=duration", "-of", "json",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_project.py (reported line 636)May include surrounding context.

python

def _write_delivery_report(output, project_root):
    result = subprocess.run(
        [
            "ffprobe", "-v", "error", "-show_entries",
            "stream=codec_type,width,height,duration:format=duration", "-of", "json", str(output),

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The argument parser sets the default language to "en", which imposes a specific language choice unless the user explicitly overrides it. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/projectlib.py:1275