Xeon Smartupscale

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:14 AM UTC
• Version: 0.1.3

Overview

The skill appears to upscale videos, but its installer automatically runs and installs remote executable dependencies without integrity checks.

Review the installer before running it. Prefer using a system ffmpeg, avoid running install.sh with elevated privileges, and install only if you are comfortable with unverified remote dependency downloads. Check output paths because existing files may be overwritten.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:24
• Finding: Remote pip Bootstrap Script Is Executed Without Integrity Verification## Vulnerability Details **File Location**: `install.sh`, line 24 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash curl -sSL https://bootstrap.pypa.io/get-pip.py | python ``` ### Technical Analysis The installer streams a remote Python script directly into the active Python interpreter. Although HTTPS protects the connection in transit under normal conditions, the effective code is controlled by the remote endpoint and can change after the Skill has been reviewed. No version pin, cryptographic checksum, signature verification, local inspection step, or trusted-copy validation is performed before execution. Bootstrapping pip may be necessary when the virtual environment lacks it, but direct `curl | python` execution is not the minimum-risk mechanism required for the Skill's video-upscaling functionality. The downloaded script executes with all permissions held by the user running `install.sh`. ### Attack Path 1. An attacker compromises the remote hosting infrastructure, its publishing process, DNS resolution, a trusted certificate authority, or another relevant part of the delivery chain. 2. The installer requests `get-pip.py` from the fixed URL. 3. The malicious or substituted response is piped directly to Python without integrity verification. 4. Python executes the response immediately. 5. The payload can read or alter files available to the installer account, modify the Skill environment, replace local executables, or launch additional processes and network connections. ### Impact Assessment Successful exploitation provides arbitrary code execution with the privileges of the account running the installer. The payload could compromise the Skill directory and virtual environment, steal user-accessible credentials or data, tamper with generated videos, or establish additional malicious behavior. The code does not request elevated privileges itself, so this finding does not indep ...[truncated 53 chars]
• Remediation: ## Remediation Suggestions - Remove the direct `curl | python` pipeline. - Prefer creating the environment with a trusted Python installation that already includes `ensurepip`, then run `python -m ensurepip`. - If an external bootstrap script is unavoidable, download a versioned copy to a temporary file, verify a pinned cryptographic digest or trusted signature, and execute it only after verification succeeds. - Use `curl --fail --show-error --location` and fail closed on download or validation errors. - Document the expected script version and digest so installation is reproducible and auditable. - Run installation as an unprivileged account and avoid invoking the installer through `sudo`.

T08 · Insecure Dependencies

Warning

• Location: install.sh:26
• Finding: Python Dependencies Are Not Fully Version- and Hash-Pinned## Vulnerability Details **File Location**: `install.sh`, lines 26–27 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium ```bash python -m pip install --upgrade pip >/dev/null python -m pip install "openvino==2025.2.0" numpy opencv-python-headless ``` ### Technical Analysis The installer upgrades pip to whatever release is current at installation time and installs `numpy` and `opencv-python-headless` without fixed versions. Even the pinned OpenVINO package and its transitive dependencies are installed without cryptographic hashes. Consequently, installations performed at different times can retrieve different executable package contents that were not present during the audit. Python wheels can contain native code and package installation or import behavior. Package-index compromise, publisher-account compromise, malicious replacement of a release, or dependency-resolution changes could therefore introduce code execution into the environment. This behavior is relevant to the Skill's functionality, but reproducible, hash-verified dependency installation would meet the same requirement with less supply-chain exposure. ### Attack Path 1. An attacker compromises a relevant package release, publisher account, package index, mirror, or transitive dependency. 2. A user runs `install.sh`. 3. pip resolves the mutable upgrade and unpinned dependency specifications. 4. The compromised wheel or source distribution is downloaded without comparison against an approved hash. 5. Malicious native or Python code executes during installation, import, or subsequent video processing. ### Impact Assessment Exploitation can result in arbitrary code execution as the installing or runtime user. A compromised dependency could access all input videos processed by the Skill, modify output files, read user-accessible local data, communicate over the network, or tamper with the virtual environment. No evidenc ...[truncated 76 chars]
• Remediation: ## Remediation Suggestions - Create a reviewed lock file that pins pip, OpenVINO, NumPy, OpenCV, and all transitive dependencies to exact versions. - Record approved SHA-256 hashes and install with `pip --require-hashes`. - Avoid an unconditional pip upgrade; pin a tested pip version or use the trusted pip supplied by the environment. - Use a controlled package index or internal artifact repository where practical. - Generate separate lock files for each supported Python and platform combination. - Add automated dependency vulnerability scanning and a controlled process for updating and reviewing pins.

T08 · Insecure Dependencies

Error

• Location: install.sh:36
• Finding: Downloaded ffmpeg Archive Is Trusted and Executed Without Verification## Vulnerability Details **File Location**: `install.sh`, lines 36–43 **Vulnerability Type**: Unverified executable dependency download **Risk Level**: High ```bash else echo "Downloading static ffmpeg..." tmp="$(mktemp -d)" curl -sSL https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz -o "$tmp/ff.tar.xz" tar -xf "$tmp/ff.tar.xz" -C "$tmp/" cp "$tmp"/ffmpeg-*-amd64-static/ffmpeg "$DIR/bin/ffmpeg" cp "$tmp"/ffmpeg-*-amd64-static/ffprobe "$DIR/bin/ffprobe" chmod +x "$DIR/bin/ffmpeg" "$DIR/bin/ffprobe" rm -rf "$tmp" ``` ### Technical Analysis When system ffmpeg tools are unavailable, the installer downloads a mutable release archive from a third-party endpoint. It does not pin a release version or verify a cryptographic checksum or signature before extraction. The copied files are marked executable and are later trusted by both `smartupscale.sh` and `sr_video_ov.py`. The download is functionally related to video processing, but accepting unverified executable binaries exceeds the minimum secure dependency acquisition behavior. In addition, extraction occurs before the archive's structure has been validated, so a malicious archive could potentially exploit unsafe archive paths or the extraction implementation. ### Attack Path 1. An attacker compromises the third-party release host, publishing account, distribution chain, DNS, TLS trust path, or the mutable archive itself. 2. A system without suitable `ffmpeg` and `ffprobe` runs `install.sh`. 3. The attacker-controlled archive is downloaded without checksum or signature validation. 4. The archive is extracted, and matching binaries are copied into the project-local `bin` directory. 5. The binaries are marked executable. 6. Subsequent Skill execution invokes these local binaries to inspect and process user-selected videos. 7. The substituted executable runs attacker code with the Skill user's permissions. ### Impact Ass ...[truncated 436 chars]
• Remediation: ## Remediation Suggestions - Prefer a trusted operating-system package or require users to provide an approved ffmpeg installation. - If bundling is required, use a fixed release URL rather than a mutable `ffmpeg-release` path. - Pin and verify a published SHA-256 digest or trusted signature before extraction. - Download with `curl --fail --show-error --location` and stop immediately on any validation failure. - Inspect archive member paths before extraction and reject absolute paths, `..` traversal, links, and unexpected files. - Extract with restrictive permissions and copy only files whose names, types, and hashes match an allowlist. - Store and document the approved ffmpeg version and provenance.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 代码的总体方向确实是视频超分与预缩放，和声明的大体主题一致；但存在实质性描述偏差。首先，脚本不是精确支持“任意目标分辨率”，而是为了适配若干次 2x 放大，将目标宽高向上对齐到特定倍数，输出可能不是用户原始请求的精确尺寸。其次，当输入分辨率已不低于目标时，脚本直接执行 Lanczos 缩放并退出，没有进行 AI 超分，这与“再做 AI 超分”的绝对表述不符。最后，声明中特别强调 CPU 推理和 Intel AMX BF16 加速，但该 shell 代码未显示任何相关能力或配置，只是调用外部 Python 脚本，因此至少从该代码片段看，这部分描述没有得到体现。综合判断为描述与实际行为存在不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: 描述与代码主功能方向大体相关，都是视频超分，但关键实现承诺不一致。代码没有接受目标分辨率参数，也没有把任意目标分辨率通过 Lanczos 预缩放到模型输入尺寸；相反，它把模型 reshape 成输入视频原始分辨率，并直接输出固定 2x 结果。代码中也没有 BF16、AMX、精度设置或 CPU 特性检测等逻辑，因此“Intel AMX BF16 加速”无法从实现中得到支持。另有一个次要未声明能力：代码会通过 ffmpeg/ffprobe 分析视频并在输出后合并音频流。综合看，描述对核心行为有明显夸大和偏差，应判定为不匹配。

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: Remote Python bootstrap code is executed without meaningful user warning or consent beyond a generic status message. Silent network retrieval plus immediate execution makes it easy for users to miss that arbitrary third-party code is being run during setup.

Chaining Abuse

High

• Category: Tool Misuse

Content

if ! python -m pip --version &>/dev/null; then
  echo "Bootstrapping pip..."
  curl -sSL https://bootstrap.pypa.io/get-pip.py | python
fi
python -m pip install --upgrade pip >/dev/null
python -m pip install "openvino==2025.2.0" numpy opencv-python-headless

• Confidence: 99% confidence
• Finding: The pipe into Python chains untrusted network input directly into an interpreter, eliminating opportunities for inspection or integrity enforcement. This materially increases exploitation risk because arbitrary remote content becomes executable in one step.

YARA rule 'privilege_escalation_tools': Privilege escalation tools and techniques [hacktools]

High

• Category: YARA Match

Content

DRVYr98oUh2gocSlUB3PKoSsVC4K
qykspK5DsGgsE7CyNGQnjSQ8sA8wDCefMV6lca0NrhcxRi3LLQcwtCtyqBssYyFcL/0kti3uLS0f
BKdBsV2xoqTTrVGy1LIqroqyJbGztVyoCS+3r0StYagAraqo0i0ALsal760oplumZKtFIjopXrA4
scwwla0nKdIskimDLAKpQDQLq+6k57O8qjwtfS6vMdqxl7QJqFOvIS6xrUKrIK0VrrQoXSoBIgMu
c6xlMEcsf6AbsLixO6gWs0ulbi0ztCOvJbEarawt76jiMMItNiT3Iekp3S30MRsnh7Qgr7ys7pnQ
LQUqJrGHtDKq7CT5rG6p1qznJ0ym7qaNp38qpS5oIvqo3y2yMPmv/BuNr1OtaKnPsPYvCjK2Ndmw
gaIcr0Gi1Z87p92oCSv8Mnmwti31pkIoSx++oymuTRWfIqSs457vKmOksa8qEB+xDbIjL08VOaUT
JO2o1KYwrfUpV6qgpdWtkSj/oF4nxyrSIPerXbFcqW8tnyTNpvUrkC3FqwgriqJRr0qp6bRPLDmq
iyS0oG6sjiWTpL+hsKdSLWKrzaQxpjmouK55pJ6xVCwOJ4YmQCB5pc4sCyvfIDcubiaJpEQbVimj
KlcXpCp9JSErr6RHJvwt1yqjHTcwmi8YrBivTS7mKjeqCDTopd21PjO2Ia+tYSlfLUGgX64MKw8s
PrB9KS2taKmLq5ge4ir7J/etOC1QK3wpJyqdLDomKycEIeAmX6BgoxGgRxB1qKOUhaF4pV+tpahp
qOAqn7FEJ9GwEbEEoeywwKzcL9+w1a6xKjuvNywdqaasKCnvoRAvUiwKLyEjmKPzLQ0zrbgNK9gk
ZTIcsGqsN67+Jyusza5TLSesrC6lJsgsO6r1IQisvyZiIQqs0x23HBOpjBt7KkCsbTLArCKzjCrH
MkmdIqzsLJurh6zfnaexajEksPMaiC1zmJSsrKoALI2nRKr

• Confidence: 75% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This markdown file describes invoking a shell script that writes output media files, including a default generated output path when `-o` is omitted. While output behavior is mentioned, there is no explicit user warning about filesystem modification or potential overwrite implications, which is expected for safety-relevant file-writing behavior in skill documentation.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The installer fetches get-pip.py over the network and immediately executes it via a pipe to Python. This creates a supply-chain execution path where a compromised upstream host, TLS-intercepting proxy, or unexpected content change results in arbitrary code execution during installation, which is broader than the stated local video upscaling function.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script performs multiple network fetches for Python packages and possibly ffmpeg with minimal disclosure. This is not inherently malicious, but it increases supply-chain exposure and reduces user awareness about what external software is being installed.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The installer downloads a prebuilt ffmpeg archive from a third-party site and installs binaries without integrity verification. While ffmpeg is plausibly related to video processing, this still introduces a supply-chain risk because tampered binaries would execute in the user's environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

else
    echo "Downloading static ffmpeg..."
    tmp="$(mktemp -d)"
    curl -sSL https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz -o "$tmp/ff.tar.xz"
    tar -xf "$tmp/ff.tar.xz" -C "$tmp/"
    cp "$tmp"/ffmpeg-*-amd64-static/ffmpeg "$DIR/bin/ffmpeg"
    cp "$tmp"/ffmpeg-*-amd64-static/ffprobe "$DIR/bin/ffprobe"

• Confidence: 84% confidence
• Finding: The curl download to a third-party ffmpeg release server is an external transmission that pulls executable content into the environment. In this skill's context, ffmpeg is functionally relevant, but fetching executable binaries from the internet without verification still creates a real compromise path.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

'-show_streams', '-show_format',
        video_path
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        raise RuntimeError(f"ffprobe failed: {result.stderr}")

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The manifest describes '任意目标分辨率（1080p/1440p/4K…）' and automatic Lanczos pre-scaling to align inputs to the ETDS 2x model. In the code, the only exposed sizing control is a generic integer '--scale' argument defaulting to 2, and output dimensions are computed strictly as input width/height multiplied by that scale; there is no target-resolution selection logic or Lanczos pre-resize path anywhere in the processing loop.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

'-crf', '18', '-pix_fmt', 'yuv420p',
            tmp_video
        ]
        pipe = subprocess.Popen(ffmpeg_cmd, stdin=subprocess.PIPE, stderr=subprocess.PIPE)

        frame_idx = 0
        total_infer_time = 0

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

'-map', '0:v:0', '-map', '1:a:0',
                '-shortest', output_video
            ]
            result = subprocess.run(merge_cmd, capture_output=True, text=True)
            if result.returncode != 0:
                print(f"Audio merge warning: {result.stderr}")
                shutil.copy2(tmp_video, output_video)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The natural-language content of the skill, including the description and operating instructions, is presented only in Chinese. Per the policy, forcing a specific language without user opt-in or clear justification is a natural-language policy concern.

External Script Fetching

Low

• Category: Supply Chain

Content

if ! python -m pip --version &>/dev/null; then
  echo "Bootstrapping pip..."
  curl -sSL https://bootstrap.pypa.io/get-pip.py | python
fi
python -m pip install --upgrade pip >/dev/null
python -m pip install "openvino==2025.2.0" numpy opencv-python-headless

• Confidence: 99% confidence
• Finding: This line is a classic remote-script execution pattern: content is fetched with curl and executed immediately by Python. Any compromise of the remote source or transport path can lead to arbitrary code execution at install time.

Intent-Code Divergence

Low

• Confidence: 95% confidence
• Finding: The pipeline comment says to pick the smallest N such that 2^N is at least the upscale ratio, then pre-scale to target/2^N before N rounds of 2x super-resolution. However, the implemented loop at L109-L116 finds the largest N for which repeated doubling still stays within the target, which is a different strategy and can yield fewer ETDS passes than documented.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: Comments, docstrings, and user-facing descriptions in this file are presented in Chinese only, with no indication that users may choose another language. The policy explicitly calls for flagging language or locale constraints when they are forced without opt-in or documented justification.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: The description promises 'Intel AMX BF16 加速', which implies deliberate BF16/AMX-oriented execution behavior. The implementation loads an OpenVINO model on a chosen device and performs inference with float32 tensors, but contains no BF16 precision selection, AMX-related configuration, or validation that such acceleration is being used.

Static analysis

No suspicious patterns detected.