Video to Notes

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:14 AM UTC
• Version: 2.0.0

Overview

This skill does what it claims: it helps turn user-provided videos or links into transcripts and AI-generated study notes, with expected dependency, download, and file-output behavior.

Install only if you are comfortable letting the agent process the specific video files or links you provide, download online videos when you approve it, install media/transcription tools after showing you the commands, and save transcripts/notes near the source video or in a chosen output directory. Prefer a virtual environment and pinned dependency versions if you want stronger supply-chain control.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8
• Finding: Unpinned Third-Party Dependencies Permit Supply-Chain Compromise<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:8-9, 42-43`; `references/workflow.md:29-44`; `scripts/download_video.py:38-40` **Vulnerability Type**: Unpinned and integrity-unverified third-party dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:8-9`: ```yaml pip: - openai-whisper ``` `SKILL.md:42-43`: ```bash python3 -c "import whisper" # Missing → pip3 install openai-whisper pip3 list 2>/dev/null | grep -q yt-dlp # Missing → pip3 install yt-dlp ``` `references/workflow.md:29-44`: ```markdown 1. Tell the user exactly which tools/packages are missing, such as "python3, ffmpeg, openai-whisper" 2. Show the complete installation command, such as `brew install python3 ffmpeg && pip3 install openai-whisper` | Platform | Python3 | ffmpeg | openai-whisper | |----------|---------|--------|-----------------| | macOS | `brew install python3` | `brew install ffmpeg` | `pip3 install openai-whisper` | | Ubuntu/Debian | `apt install python3` | `apt install ffmpeg` | `pip3 install openai-whisper` | | Windows | Download from python.org | `winget install ffmpeg` | `pip install openai-whisper` | ### yt-dlp pip3 install yt-dlp ``` `scripts/download_video.py:38-40`: ```python print("❌ 未找到 yt-dlp，请先安装:") print(" brew install yt-dlp") print(" 或: pip3 install yt-dlp") ``` ### Technical Analysis The Skill declares and recommends installing `openai-whisper` and `yt-dlp` without exact version constraints, cryptographic hashes, a lock file, or an explicitly trusted package index. As a result, installation resolves whatever package release and transitive dependency versions are available from the configured package repositories at execution time. User confirmation before installation prevents silent package installation, but it does not verify the integrity or provenance of the selected artifacts. A compromised upstream release, package repository, maintainer account, transitive dependency, or locally configured package in ...[truncated 2207 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to a reviewed exact version: ```text openai-whisper==<reviewed-version> yt-dlp==<reviewed-version> ``` 2. Maintain a lock file that records all transitive dependencies. Generate and review it in a controlled environment rather than resolving dependencies dynamically during normal Skill execution. 3. Require cryptographic hashes for downloaded Python distributions, for example through a hash-locked requirements file and: ```bash python3 -m pip install --require-hashes -r requirements.lock ``` 4. Install dependencies in an isolated virtual environment instead of the user's global Python environment: ```bash python3 -m venv .venv .venv/bin/python -m pip install --require-hashes -r requirements.lock ``` 5. Use an explicitly configured trusted package index or an internally mirrored repository containing reviewed artifacts. Do not rely implicitly on arbitrary user or system package-index configuration. 6. Pin or otherwise control Homebrew and operating-system package versions where practical, and document the expected repositories and package provenance. 7. Document Whisper model download sources and expected checksums. Verify model artifacts before loading them where the supporting library permits this. 8. Continue requiring explicit user approval, but expand the prompt to display the exact pinned versions, source repository, installation target, and integrity-verification method. 9. Periodically update dependency pins through a controlled review process that includes vulnerability scanning, provenance checks, and regression testing. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: 声明描述的是一个完整的“视频转学习笔记”流程型技能，核心产出应是结构化笔记；而实际代码只是一个独立的视频下载脚本，主要能力是通过 yt-dlp 下载网络视频。虽然“支持网络链接”这一点与总体场景部分相关，但该代码缺失声明中的关键核心步骤和最终输出，因此其实际行为与声明的主要用途存在实质性不匹配。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: 声明描述的是一个端到端的视频学习笔记生成工具，核心产出应是结构化笔记，并支持网络视频链接输入。实际代码只包含转写脚本：检查 ffmpeg、提取本地媒体文件音频、可做静音裁剪/变速、调用 Whisper 转写、将结果写入 .txt。没有任何下载/解析 YouTube 或 B站链接的逻辑，也没有任何对转写内容进行总结、提炼、分层组织、生成要点或结构化笔记的 AI 后处理步骤。因此，代码行为与声明的核心价值和主要能力存在实质性不一致。

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to use shell commands and write files, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this increases the chance of unintended command execution, package installation, downloads, and filesystem changes beyond what users reasonably expect.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad enough that ordinary user requests like '帮我记笔记' could invoke a skill that performs shell operations, file access, dependency checks, and possibly video downloads. Overbroad invocation increases the chance of accidental activation and unexpected processing of local files or remote URLs.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: Stating that a single generic phrase is sufficient to start the workflow lowers the bar for unintended invocation of a capability that may access files, run ffmpeg, install packages, or download content. In this skill context, that makes accidental execution more likely and reduces informed user consent.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file is entirely written as normative guidance in Chinese and instructs the AI how to generate notes, but it does not indicate that the language should follow user preference or allow opting into another locale. Under the policy rule for natural-language constraints, this creates a language-default requirement without documented user choice.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The manifest describes a workflow of extracting audio, transcribing with Whisper, and generating notes from provided video files or links. This helper instead shells out to yt-dlp via subprocess, introducing arbitrary external program execution rather than performing note-generation or media processing directly; subprocess execution is a stronger capability than the learning-note purpose itself requires.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

]

    try:
        result = subprocess.run(cmd, capture_output=True, text=True)
        if result.returncode != 0:
            print(f"❌ 下载失败: {result.stderr}")
            return None

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

]

    try:
        result = subprocess.run(cmd, capture_output=True, text=True)
        if result.returncode != 0:
            print(f"❌ 下载失败: {result.stderr}")
            return None

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def get_video_duration(video_path):
    """获取视频时长(分钟)"""
    try:
        result = subprocess.run(
            ["ffprobe", "-v", "error", "-show_entries",
             "format=duration", "-of", "default=noprint_wrappers=1:nokey=1",
             video_path],

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: 技能清单声明该技能的核心流程包含“Whisper 语音转文字 → AI 生成结构化笔记”，面向的是将视频自动整理成高质量结构化学习笔记。但此文件的实际输出逻辑仅把 Whisper 分段结果按时间戳写入 .txt 文本，没有任何笔记整理、结构化提炼、摘要或要点生成步骤，实际行为更接近单纯转录工具。

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: 技能描述明确写明“支持本地视频文件、YouTube/B站等网络链接”，且触发条件也包含用户提供视频链接。但该脚本只检查本地路径是否存在并按文件扩展名过滤，随后直接交给 ffmpeg/ffprobe 处理，本身没有任何链接解析、下载或站点处理逻辑，因此与宣称的输入范围不一致。

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This file includes natural-language descriptions and CLI help text only in Chinese, which effectively forces a specific language for users. Under the stated policy, language constraints should offer user opt-in or be clearly justified as region-specific.

Static analysis

No suspicious patterns detected.