Video Subtitle Translation & Dubbing

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:36 PM UTC
• Version: 0.1.4

Overview

The skill appears to perform the advertised subtitle translation and dubbing workflow, but it should be reviewed because it can send subtitles, TTS text, and provider API keys to arbitrary endpoints, including unencrypted HTTP URLs.

Review the provider configuration before installing or running. Use only trusted HTTPS translation and TTS endpoints, avoid processing sensitive or unauthorized media unless the provider is approved for that data, and scope API keys to the minimum permissions and spend limits possible.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/translation_dubbing_skill/entry/manifest.py:443
• Finding: Provider endpoints permit plaintext transmission of API credentials and subtitle content<![CDATA[ ## Vulnerability Details **File Locations**: - `src/translation_dubbing_skill/entry/manifest.py:443-452` - `src/translation_dubbing_skill/entry/manifest.py:511-520` - `src/translation_dubbing_skill/providers/translation/llm.py:224-234` - `src/translation_dubbing_skill/providers/tts/minimax.py:201-208` **Vulnerability Type**: Plaintext transmission of sensitive information through unrestricted provider endpoints **Risk Level**: Medium ### Vulnerable Code The manifest validates provider endpoints only as non-empty strings: ```python translation_endpoint = _require_str( params.get("translation_endpoint"), "translation_endpoint", missing=missing, ) translation_credential = _require_str( params.get("translation_credential"), "translation_credential", missing=missing, ) ``` The same issue applies to TTS endpoints: ```python tts_endpoint = _require_str( params.get("tts_endpoint"), "tts_endpoint", missing=missing_tts ) tts_credential = _require_str( params.get("tts_credential"), "tts_credential", missing=missing_tts ) ``` The translation provider sends the credential and subtitle content to the accepted endpoint: ```python payload = self._build_request_body(entries, target_language, source_language) headers = { "Authorization": f"Bearer {self.credential}", "Content-Type": "application/json", } client = self._get_client() try: response = await client.post( self.endpoint, json=payload, headers=headers ) ``` The MiniMax TTS provider similarly sends its credential and synthesized text payload to the configured endpoint: ```python headers = { "Authorization": f"Bearer {self.credential}", "Content-Type": "application/json", } client = self._get_client() try: response = await client.post( self.endpoint, json=payload, headers=headers ) ``` ### Technical Analysis The endpoint validation logic requires only a non-empty string and does not parse the URL or enforce an encrypted t ...[truncated 3052 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse every provider endpoint with `urllib.parse.urlparse` before constructing provider configuration. 2. Require the `https` scheme for all non-local provider endpoints. 3. If plaintext HTTP is needed for development, require an explicit opt-in and limit it to loopback hosts such as `127.0.0.1`, `::1`, or `localhost`. 4. Reject malformed URLs, URLs without a hostname, unsupported schemes, and URLs containing embedded user information. 5. Apply the validation consistently to translation, generic TTS, LLM TTS, web TTS, and MiniMax endpoints. 6. Consider an optional allowlist of approved provider hosts for managed deployments. 7. Ensure provider requests cannot silently downgrade from HTTPS to HTTP. 8. Document clearly that subtitle text is disclosed to the configured third-party providers. 9. Add automated tests confirming that: - HTTPS endpoints are accepted. - Remote HTTP endpoints are rejected. - Loopback HTTP endpoints require an explicit development option. - Schemes such as `file`, `ftp`, and arbitrary custom schemes are rejected. - Credentials never appear in serialized errors or progress events. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (73)

Credential Access

High

• Category: Privilege Escalation

Content

### 3. 配置凭证
复制环境变量模板文件并填写你的 API Keys：
```bash
cp .env.example .env
```
根据 `.env` 中的说明，配置你的大模型或翻译/TTS 提供商凭证。

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### 3. 配置凭证
复制环境变量模板文件并填写你的 API Keys：
```bash
cp .env.example .env
```
根据 `.env` 中的说明，配置你的大模型或翻译/TTS 提供商凭证。

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description claims a multi-language subtitle translation and automatic dubbing skill. However, the supplied code only parses and cleans caption files: it removes WebVTT/SRT artifacts, merges atomic cues into sentence-level cues, and outputs cleaned subtitle files. There is no translation engine, no calls to language models or translation APIs, no speech synthesis/dubbing, no audio/video handling, and no language-specific processing beyond simple regex support for sentence splitting. This is a material mismatch in primary purpose and capabilities, not just an implementation detail.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: This code chunk does match part of the description: it is clearly a subtitle translation component. However, it does not implement automatic dubbing or any audio/video synthesis behavior. Its primary concrete behavior is making authenticated HTTP requests to an LLM endpoint to translate subtitle text batches. That external network access and credential use are meaningful resource interactions not reflected in the declared permissions ([]). While the broader skill may include dubbing elsewhere, this supplied chunk itself is specifically a translation provider, so the declared description overstates the capabilities represented by the code shown.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The supplied code chunk does not implement a full 'multi-language video subtitle translation and automatic dubbing' skill. Instead, it defines a structural protocol for translation providers: initialization, sizing text payloads, and translating subtitle batches. There is no dubbing, audio generation, speech synthesis, or video processing in this chunk. Additionally, the comments/contracts specifically mention simplified Chinese output and a default target language of zh-CN, which is narrower than the declared broad multilingual capability. While this code is related to subtitle translation support, its actual purpose is lower-level translation-provider interface infrastructure, not the full declared translation-and-dubbing functionality.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code clearly aligns with part of the declared purpose: subtitle text translation across languages via a third-party web API. However, the declared description prominently includes automatic dubbing and a broader video-subtitle workflow, while the actual code only translates text entries and manages HTTP/API concerns. There is no evidence of audio generation, speech synthesis, dubbing, video handling, or media pipeline behavior in this chunk. This is a material description-to-behavior mismatch because the implemented capability shown is substantially narrower than the declared skill purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This code chunk’s primary purpose is scheduler configuration and validation for provider rate limiting, not multi-language subtitle translation or automatic dubbing. While such scheduling could be a supporting subsystem inside a translation/dubbing product, the actual behavior shown here is purely infrastructure-oriented and lacks any direct implementation of video processing, subtitle translation, speech synthesis, dubbing, or multilingual pipeline handling. Therefore, the supplied code does not accurately represent the declared skill purpose for this chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description promises a multi-language subtitle translation and automatic dubbing capability across many languages. The provided code does not translate subtitles, does not dub audio, and does not handle multiple target languages. Instead, it shells out to ffmpeg to extract an existing embedded English subtitle track and normalize it to SRT. While subtitle extraction could be a supporting component of a larger translation/dubbing workflow, this code chunk's actual behavior is materially narrower than the declared purpose and does not implement the headline capabilities described.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises a user-facing skill for multi-language subtitle translation and automatic dubbing. However, this code chunk is narrowly focused on parsing subtitle text files (SRT/VTT) into structured entries and validating timestamps. That is a supporting utility for subtitle workflows, but by itself it does not implement the declared core capabilities of translation or dubbing. There are no undeclared sensitive behaviors, permissions, or triggers in this snippet; the mismatch is that the actual behavior is materially narrower and different from the stated primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises a user-facing skill for translating subtitles across multiple languages and automatically dubbing video. The supplied code chunk does not implement translation, language processing, speech synthesis, video/audio manipulation, or dubbing. Instead, it is a subtitle serializer/pretty-printer that converts SubtitleEntry objects into SRT or VTT formats and writes them to disk. While subtitle serialization could be a supporting component within a larger translation/dubbing system, this chunk by itself materially differs from the declared primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: This code chunk clearly matches subtitle translation functionality, including provider orchestration, batching, retry/error handling, and progress reporting. However, it does not implement automatic dubbing or any audio/video processing. The declared description presents the skill as both subtitle translation and automatic dubbing, which overstates what this code actually does. Additionally, while the description emphasizes broad multilingual support, the implementation contains explicit semantic checks for Chinese output when the target language starts with 'zh', suggesting this module is especially oriented toward Chinese translation rather than demonstrating general dubbing or broad language-processing behavior. Therefore, the description does not accurately represent this supplied code chunk.

Credential Access

High

• Category: Privilege Escalation

Content

def load_env() -> None:
    """Simple parser to load variables from a local .env file."""
    env_path = PROJECT_ROOT / ".env"
    if not env_path.exists():
        print("💡 Hint: No .env file found in project root. Reading from system environments.")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def load_env() -> None:
    """Simple parser to load variables from a local .env file."""
    env_path = PROJECT_ROOT / ".env"
    if not env_path.exists():
        print("💡 Hint: No .env file found in project root. Reading from system environments.")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def load_env() -> None:
    """Simple parser to load variables from a local .env file."""
    env_path = PROJECT_ROOT / ".env"
    if not env_path.exists():
        print("💡 Hint: No .env file found in project root. Reading from system environments.")

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def load_env() -> None:
    """Simple parser to load variables from a local .env file."""
    env_path = PROJECT_ROOT / ".env"
    if not env_path.exists():
        print("💡 Hint: No .env file found in project root. Reading from system environments.")
        return

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

def load_env() -> None:
    """Simple parser to load variables from a local .env file."""
    env_path = PROJECT_ROOT / ".env"
    if not env_path.exists():
        print("💡 Hint: No .env file found in project root. Reading from system environments.")
        return

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README instructs users to configure external translation and TTS HTTP endpoints with credentials, but it does not clearly warn that video, subtitle, and possibly audio content will be transmitted to third-party services. In this skill’s context, the processed media may contain sensitive spoken or textual data, so the omission can lead to unintended privacy exposure and compliance issues.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly documents network-based translation and TTS backends plus API credential use, but it does not warn users that subtitle text, audio-derived text, and possibly dubbing content may be transmitted to third-party services. In this skill context, that omission matters because videos and subtitles often contain sensitive or copyrighted content, so users may unknowingly exfiltrate data to external providers.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- **Python 3.11+**
- **FFmpeg**：需要在系统的 `PATH` 环境变量中可用。
  - **macOS**: `brew install ffmpeg`
  - **Ubuntu**: `sudo apt install ffmpeg`

### 2. 安装依赖
克隆项目后，在根目录下执行：

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

- **Python 3.11+**
- **FFmpeg**：需要在系统的 `PATH` 环境变量中可用。
  - **macOS**: `brew install ffmpeg`
  - **Ubuntu**: `sudo apt install ffmpeg`

### 2. 安装依赖
克隆项目后，在根目录下执行：

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The project description says the skill will 'translate English video subtitles to Chinese' and optionally dub Chinese audio, which imposes a specific output language/locale in natural-language metadata. There is no indication here that users can choose another language or explicitly opt into the Chinese-only behavior.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import subprocess

    try:
        result = subprocess.run(
            [
                "ffprobe",
                "-v",

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The script hard-codes `target_language="zh-CN"`, which enforces a specific language/locale for all runs. This is a natural-language policy concern because users are not offered a language choice or opt-in, and the file does not document a region-specific reason for the restriction.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The usage text explicitly describes '中文配音' and hard-codes zh-CN voices as the examples/defaults, and the script defaults --voice-id to Chinese locale voices. This appears to impose a specific language/locale behavior without opt-in or an explicit statement that the tool is intentionally China/Chinese-specific.

Static analysis

No suspicious patterns detected.