Skill Video Caption Overlay

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:13 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent video-caption rendering utility with disclosed local file input and output behavior, but users should be aware that its documented command installs unpinned Python packages at run time.

Before installing or running, consider pinning MoviePy and Pillow in a locked environment and choose an output path that will not overwrite important files. Review or replace the example captions, especially the UAE-specific sample ad text, for your intended audience.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Runtime Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17
Related Location: scripts/overlay.py:15-16
Vulnerability Type: Unpinned third-party runtime dependencies
Risk Level: Medium

The documented execution command installs MoviePy and Pillow without version constraints:

bash

uv run --with moviepy --with pillow scripts/overlay.py \
  --video base.mp4 \
  --output final.mp4 \
  --captions scripts/example_captions.json \
  --audio music.mp3 \
  --audio-start 8 \
  --audio-vol 0.5

The script also states that these dependencies are installed automatically:

python

Dependencies (auto-installed by uv):
  moviepy, pillow

Technical Analysis

The command uses uv run --with to resolve and install unspecified versions of MoviePy and Pillow at execution time. The project contains no reviewed lockfile, exact version constraints, or package hashes. Consequently, dependency resolution can produce code that differs from the versions originally reviewed.

This creates a supply-chain risk: a compromised package release, maliciously altered upstream distribution, or newly vulnerable dependency version could be installed and imported into the process. Merely being unpinned does not establish that either dependency is currently malicious, but it removes reproducibility and permits the effective third-party code executed by the Skill to change after review.

Attack Path

1. A user follows the command documented in SKILL.md.
2. uv contacts its configured package index and resolves the current versions of moviepy, pillow, and their transitive dependencies.
3. A compromised or otherwise unsafe dependency version is selected because no exact versions or trusted hashes constrain resolution.
4. The dependency is installed into the runtime environment.
5. Python imports MoviePy or Pillow while launching scripts/overlay.py.
6. Malicious package initialization or reachable dependency code executes with the same operating-system permission ...[truncated 784 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare exact, reviewed versions for MoviePy, Pillow, and all transitive dependencies.

2. Generate and commit a uv.lock file, then require locked or frozen dependency resolution during execution.

3. Use package hash verification where supported so modified distributions cannot silently replace reviewed artifacts.

4. Replace the ad hoc --with moviepy --with pillow workflow with a reproducible project environment, for example:

   bash

   uv sync --frozen
   uv run scripts/overlay.py \
     --video base.mp4 \
     --output final.mp4 \
     --captions scripts/example_captions.json
   

5. Configure uv to use an explicitly trusted package index and prevent unexpected fallback to untrusted sources.

6. Add automated dependency vulnerability and integrity scanning, and update pins through a controlled review process.

7. Document the supported Python version and platform to improve reproducibility across environments.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This JSON content includes the phrase "Free delivery UAE," which constrains the offering to a specific locale. Under the policy rule for natural-language violations, locale-specific language should either provide user choice or be clearly documented as a justified regional constraint, which is not present in this file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This code performs a file write by rendering and saving the final video to the path provided in --output. While the script prints a completion message afterward, there is no confirmation prompt or pre-action disclosure near the write operation itself warning that a file will be created or overwritten.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.