Skill Tiktok Video Pipeline

• Analyzed: May 11, 2026, 5:01 AM
• Findings: 1
• Version: 2.0.0
• Hash: 4ff31871eb0830e1d06509fc80dfab0367305b7d95ad88daefcbd2e23db6ac1e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `scripts/tiktok_overlay_engine_v3.py` script is vulnerable to `ffmpeg` filter injection. User-controlled arguments like `--pill-color` and `--text-color` are directly concatenated into the `ffmpeg` `drawtext` filter string without proper escaping, allowing an attacker to inject arbitrary `ffmpeg` filters. This can lead to information disclosure, denial of service, or potentially remote code execution. While `scripts/generate.js` uses `JSON.stringify` to mitigate direct shell injection for its arguments, the downstream `tiktok_overlay_engine_v3.py` script introduces a critical vulnerability.