Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly coherent for local Yaps video clipping, but its bundled runtime exposes broader Yaps command and transcription workflows than the advertised clipping purpose clearly scopes.
Install only if you are comfortable giving this skill access to run the local Yaps helper against files you select. Prefer using it for the documented Auto Cut workflow, review output paths before rendering, and do not approve unexpected Keychain prompts or unrelated Yaps operations.
The top comment claims the adapter writes no diagnostics, credentials, settings, or host permissions, which can mislead reviewers into underestimating the code's effective privileges. In reality, the file reads and writes local files, creates temp directories, links output files, reads stdin/request files, and spawns an external process, so the assurance is inaccurate and security-relevant.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
function accountStatusUnsafeDiagnosis(appVersion) {
return {
code: "account_status_unsafe",
message: `Yaps ${appVersion || "before 2.3.124"} uses an older credential-based account check, so this plugin deliberately did not run it. Update Yaps to 2.3.124 or newer; the plugin will then reuse the desktop sign-in, trial, or Yaps Pro automatically. Do not approve a Keychain prompt or create a separate plugin account.`,
};
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
function accountStatusUnsafeDiagnosis(appVersion) {
return {
code: "account_status_unsafe",
message: `Yaps ${appVersion || "before 2.3.124"} uses an older credential-based account check, so this plugin deliberately did not run it. Update Yaps to 2.3.124 or newer; the plugin will then reuse the desktop sign-in, trial, or Yaps Pro automatically. Do not approve a Keychain prompt or create a separate plugin account.`,
};
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
function accountStatusUnsafeDiagnosis(appVersion) {
return {
code: "account_status_unsafe",
message: `Yaps ${appVersion || "before 2.3.124"} uses an older credential-based account check, so this plugin deliberately did not run it. Update Yaps to 2.3.124 or newer; the plugin will then reuse the desktop sign-in, trial, or Yaps Pro automatically. Do not approve a Keychain prompt or create a separate plugin account.`,
};
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
function accountStatusUnsafeDiagnosis(appVersion) {
return {
code: "account_status_unsafe",
message: `Yaps ${appVersion || "before 2.3.124"} uses an older credential-based account check, so this plugin deliberately did not run it. Update Yaps to 2.3.124 or newer; the plugin will then reuse the desktop sign-in, trial, or Yaps Pro automatically. Do not approve a Keychain prompt or create a separate plugin account.`,
};
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
message: "Yaps is signed in, but its trial or Yaps Pro access is not active. Open Yaps to review the available trial or Yaps Pro options; the plugin will pick up the change automatically.",
};
}
if (auth.status === "credential_unavailable" || auth.diagnosticCode === "keychain_unavailable") {
return {
code: "account_status_unsupported",
message: "This installed Yaps helper uses an older credential-based account check. Update Yaps and retry. Do not approve a Keychain prompt or create a separate plugin account.",
The skill invokes external command-line functionality (<yaps>, cut, and related operations), but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and review gap: an agent may still attempt environment or shell-backed execution without a narrowly declared boundary, increasing the chance of unintended command access or misuse.
The code supports generic pass-through execution of Yaps CLI arguments, including plain argv, request arrays, and args-file modes, rather than enforcing a narrow clipping-only command set. Even though it avoids shell injection, this still grants callers a broad capability surface through an external helper, allowing unintended operations on local media and accounts beyond the advertised skill scope.
The adapter exposes transcription and subtitling workflows that are broader than the declared purpose of shortening talking-head videos. That capability expansion increases the accessible attack surface and allows collection/export of speech content from arbitrary local media files, which is a scope mismatch users and hosts may not expect from a video-clipping skill.
The meeting transcription path goes further by extracting audio from video and generating meeting transcripts/projects, which is materially different from simple clip editing. In a skill advertised for video clipping, this can enable unintended processing and persistence of sensitive spoken content, making the scope mismatch more dangerous in context.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
export const MIN_SAFE_AUTH_STATUS_VERSION = "2.3.124";
const MAX_PROBE_BYTES = 64 * 1024;
const MAX_VERSION_BYTES = 4 * 1024;
const MAX_PLIST_BYTES = 64 * 1024;
const MAX_WINDOWS_SHIM_BYTES = 4 * 1024;
const RUNNING_YAPS_PROCESS_NAMES = new Set(["yaps.exe", "yaps_mcp.exe", "yaps_cli.exe"]);
// Fixed WMI filter: never interpolate a discovered path into this command.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
export const MIN_SAFE_AUTH_STATUS_VERSION = "2.3.124";
const MAX_PROBE_BYTES = 64 * 1024;
const MAX_VERSION_BYTES = 4 * 1024;
const MAX_PLIST_BYTES = 64 * 1024;
const MAX_WINDOWS_SHIM_BYTES = 4 * 1024;
const RUNNING_YAPS_PROCESS_NAMES = new Set(["yaps.exe", "yaps_mcp.exe", "yaps_cli.exe"]);
// Fixed WMI filter: never interpolate a discovered path into this command.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
if (platform === "darwin") {
const application = macApplicationForCli(cli.path, canonicalize);
if (!application) return null;
const plist = posix.join(application, "Contents", "Info.plist");
try {
const metadata = statFile(plist);
if (!metadata.isFile() || metadata.size > MAX_PLIST_BYTES) return null;
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
if (platform === "darwin") {
const application = macApplicationForCli(cli.path, canonicalize);
if (!application) return null;
const plist = posix.join(application, "Contents", "Info.plist");
try {
const metadata = statFile(plist);
if (!metadata.isFile() || metadata.size > MAX_PLIST_BYTES) return null;
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
if (platform === "darwin") {
const application = macApplicationForCli(cli.path, canonicalize);
if (!application) return null;
const plist = posix.join(application, "Contents", "Info.plist");
try {
const metadata = statFile(plist);
if (!metadata.isFile() || metadata.size > MAX_PLIST_BYTES) return null;
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
if (platform === "darwin") {
const application = macApplicationForCli(cli.path, canonicalize);
if (!application) return null;
const plist = posix.join(application, "Contents", "Info.plist");
try {
const metadata = statFile(plist);
if (!metadata.isFile() || metadata.size > MAX_PLIST_BYTES) return null;
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
if (platform === "darwin") {
const application = macApplicationForCli(cli.path, canonicalize);
if (!application) return null;
const plist = posix.join(application, "Contents", "Info.plist");
try {
const metadata = statFile(plist);
if (!metadata.isFile() || metadata.size > MAX_PLIST_BYTES) return null;
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
if (platform === "darwin") {
const application = macApplicationForCli(cli.path, canonicalize);
if (!application) return null;
const plist = posix.join(application, "Contents", "Info.plist");
try {
const metadata = statFile(plist);
if (!metadata.isFile() || metadata.size > MAX_PLIST_BYTES) return null;