视频运镜分析工具

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:10 AM UTC
• Version: 1.0.0

Overview

This skill locally analyzes user-provided videos and writes disclosed analysis output, with no evidence of hidden network access, credential use, persistence, or destructive behavior.

Install the Python dependencies in a virtual environment, prefer pinned package versions if you need reproducibility, and avoid running the tool on sensitive videos unless you are comfortable with representative frames being copied into the local analysis JSON output.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:10

Finding

Unpinned Third-Party Dependencies Permit Unreviewed Package Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–12
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Low

bash

py -m pip install opencv-python-headless numpy pillow

Technical Analysis

The documented installation command installs three packages without exact version constraints or integrity hashes. Consequently, users may receive package versions that differ from those reviewed or tested by the project. The effective dependency code can change over time without any corresponding change to this repository.

The package names appear to be legitimate and the audit found no evidence that they are currently malicious. Exploitation therefore depends on an upstream package or package-distribution channel being compromised. This is a supply-chain hardening weakness rather than evidence of an embedded payload.

The dependencies are functionally appropriate for local video and image analysis. However, unrestricted installation exceeds the minimum reproducibility requirement because it allows any future version satisfying no constraints at all to execute installation and runtime code in the user's Python environment.

Attack Path

1. An attacker compromises one of the named package distributions, a maintainer account, or the configured Python package index.
2. The attacker publishes a malicious or compromised package release under the expected package name.
3. A user follows the documented installation command after that release becomes available.
4. pip resolves and installs the unreviewed release.
5. Package installation hooks or subsequently imported package code executes with the privileges of the user running the command.

This attack path is conditional; no current compromise was identified during the audit.

Impact Assessment

A compromised dependency could execute arbitrary Python code with the privileges of the installing or invoking user. Potential impact includes access to files readable by that ac ...[truncated 536 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin all dependencies to reviewed versions in a dedicated requirements file, for example:

   text

   opencv-python-headless==<reviewed-version>
   numpy==<reviewed-version>
   pillow==<reviewed-version>
   

2. Generate and verify cryptographic hashes for every distribution, such as with pip-tools, and install using:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Use a trusted, explicitly configured package index and prevent unintended fallback to additional indexes.

4. Run dependency vulnerability and provenance checks in CI.

5. Review and update pinned versions through a controlled process rather than resolving unrestricted latest releases at installation time.

6. Recommend installation inside an isolated virtual environment under a non-privileged account.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger text includes broad, everyday phrases such as “分析这个视频” and “帮我拆镜”, which can cause the skill to activate in situations where the user did not explicitly intend to use this specific tool. Because the skill processes uploaded files and performs automatic analysis, unintended invocation could expose user content to unnecessary processing or produce confusing, unsolicited outputs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description states that it generates English AI prompts by default, without indicating any user choice or locale-sensitive behavior. This can override user expectations and cause unwanted transformation of content into another language, which is especially problematic when users expect analysis only or prefer output in their original language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module description and nearly all CLI messages are hard-coded in Chinese, and stdout is configured for UTF-8 output accordingly. This imposes a specific language on users without opt-in or an alternative locale option, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script embeds representative video frames as base64 JPEGs into analysis.json, which persists visual content from the input video without any opt-in, warning, redaction, or retention control. If the videos contain sensitive material, this creates an unnecessary secondary copy of user data that may be easier to exfiltrate, index, log, or reuse than the original media file.

Content

No source excerpt is available for this finding.