Security audit

视频字幕提取与总结（B站+抖音+YouTube+小红书）

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly a video subtitle and summary helper, but it needs review because crafted URLs can make it fetch unintended network destinations while downloading and caching media.

Install only if you are comfortable with the agent downloading or extracting media, running ASR models, and keeping generated files in a local cache. Use trusted URLs and local files, avoid processing links from untrusted parties, and prefer running it with network egress controls that block loopback, private, and metadata-service addresses. Review or clear its cache if transcripts may contain sensitive content, and pin dependencies/models in a controlled environment before serious use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/video_fetcher.py:51
Finding: Weak URL and Redirect Validation Permits Server-Side Request Forgery
Content: View full analysis
str: """识别链接平台：bilibili / douyin / youtube / xiaohongshu / unknown""" t = text.lower() if "bilibili.com" in t or re.search(r"(BV[0-9A-Za-z]{10})", t, re.IGNORECASE): return "bilibili" if "douyin.com" in t or "tiktok.com" in t: return "douyin" if "youtube.com" in t or "youtu.be" in t: return "youtube" if "xiaohongshu.com" in t or "xhslink.com" in t or "xhs.cn" in t: return "xiaohongshu" return "unknown" ``` From `scripts/video_fetcher.py:196-226`: ```python def resolve_douyin_url(short_url: str) -> str: """解析抖音短链接，获取重定向后的实际 URL""" try: req = urllib.request.Request(short_url, headers={ "User-Agent": HEADERS["User-Agent"], }) opener = urllib.request.build_opener(urllib.request.HTTPRedirectHandler) resp = opener.open(req, timeout=10) return resp.url except Exception as e: print(f"[!] 解析短链接失败: {e}", file=sys.stderr) return short_url def fetch_douyin_info(url: str) -> dict: """获取抖音视频基本信息（通过网页解析，无需API Key）""" if "v.douyin.com" in url: url = resolve_douyin_url(url) print(f"[*] 抖音实际链接: {url}", file=sys.stderr) video_id = "" m = re.search(r"/video/(\d+)", url) if m: video_id = m.group(1) try: req = urllib.request.Request(url, headers={ "User-Agent": HEADERS["User-Agent"], "Referer": "https://www.douyin.com/", ...[truncated 3789 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: scripts/speech_to_text.py:55
Finding: Unpinned Dependencies and Mutable Runtime Model Downloads Create Supply-Chain Risk
Content: View full analysis
list: """使用 FunASR Paraformer 模型""" from funasr import AutoModel print("[*] 加载 FunASR Paraformer 模型（首次运行会下载约 1GB）...", file=sys.stderr) model_kwargs = { "model": "paraformer-zh", "vad_model": "fsmn-vad", "punc_model": "ct-punc-c", "disable_update": True, } # 说话人分离需要额外加载 SD 模型 sd_model = None if diarize: try: print("[*] 加载说话人分离模型（SD）...", file=sys.stderr) sd_model = AutoModel( model="cam++", disable_update=True, ) ``` From `scripts/speech_to_text.py:139-145`: ```python print("[*] 加载 SenseVoice 模型...", file=sys.stderr) model = AutoModel( model="iic/SenseVoiceSmall", vad_model="fsmn-vad", vad_kwargs={"max_single_segment_time": 30000}, disable_update=True, ) ``` From `scripts/speech_to_text.py:169-172`: ```python import whisper print("[*] 加载 Whisper 模型 (base)（首次运行会下载约 140MB）...", file=sys.stderr) model = whisper.load_model("base") ``` ### Technical Analysis The installation instructions request the latest versions of multiple packages without exact version constraints, lockfiles, integrity hashes, or an isolated environment. A future installation can therefore resolve to a dependency graph different from the version reviewed during this audit. The AS ...[truncated 2257 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (61)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: There is a clear description-behavior mismatch. The declared skill is a broad multi-platform video analysis/subtitle tool, but this code is a narrow utility for downloading audio from Bilibili videos. It specifically regex-extracts BV IDs, invokes yt-dlp/ffprobe, writes an m4a file, and returns metadata. Those actions may be a supporting step for later transcription, but standing alone they do not implement the declared user-facing capabilities, and the platform/file support is materially narrower than described.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broad multi-platform video-processing skill that can extract subtitles, summarize videos, and assess information density, including support for local video files. The supplied code implements a much narrower function: it extracts a Bilibili BV ID, calls Bilibili APIs to retrieve video info, tags, and subtitle data, and prints the results as JSON. There is no handling for Douyin, YouTube, Xiaohongshu, xhslink URLs, or local video files, and no implementation of summarization or information-density evaluation. The code's primary purpose is subtitle and metadata retrieval for Bilibili only, so the description materially overstates the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a multi-platform video subtitle/summarization skill, but the supplied code is a Bilibili-only danmaku analyzer. It extracts a BV number, calls Bilibili video and danmaku APIs, parses XML danmaku, and computes word-frequency, density, and highlight danmaku outputs. The code explicitly rejects non-Bilibili inputs ('仅支持B站视频弹幕分析'). There is no handling of local files, no downloading or parsing of video/audio streams, no ASR/subtitle extraction, and no support for Douyin/YouTube/Xiaohongshu. The primary purpose is materially different from the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description centers on subtitle extraction, video summarization, and information-density evaluation for shared video links or local files. However, the supplied code's primary and only evident function is keyframe extraction: it identifies the input type, optionally downloads online videos with yt-dlp, uses ffmpeg/ffprobe to measure duration and extract still frames either by interval or scene detection, saves JPGs, and returns metadata about those images. There is no audio processing, ASR, subtitle parsing, summarization, or content-density analysis. Additionally, the detector recognizes Bilibili, Douyin/TikTok, and YouTube, but not Xiaohongshu/xhslink despite the description claiming support. This is a material description-behavior mismatch, not just an implementation detail.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The description is partially aligned because the code clearly handles the declared input types (major video platforms plus local files) and performs subtitle extraction via API subtitles or ASR. However, the declared purpose also says the skill should summarize video content and evaluate information density, which this code does not do. That is a material description/behavior gap because those are user-facing primary capabilities, not minor implementation details. In addition, the code includes several extra user-relevant features not mentioned in the description: batch processing, Bilibili favorites/series collection expansion, keyframe extraction, danmaku analysis, and optional speaker diarization. These are meaningful undeclared capabilities, though less central than the missing summarization and density analysis. Overall, the description does not accurately represent the full behavior, and it overstates key functions that are absent in the supplied code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description presents a broader video-analysis skill triggered by video links or local video files, with capabilities including subtitle extraction, summarization, and information-density assessment. The supplied code only performs ASR/transcription on a local audio file path, with optional speaker diarization and SRT export. While subtitle extraction is partially aligned in spirit, the implementation is materially narrower and misses several core declared behaviors: it does not accept or resolve platform URLs, does not download or parse online videos, does not summarize, does not score information density, and does not process video containers unless converted externally to audio. Therefore the description does not accurately represent the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a user-facing video analysis skill triggered by shared platform links or local video files, with core functions of extracting subtitles, summarizing videos, and evaluating information density. This code chunk instead implements a command-line subtitle storage/management utility. Its functions are CRUD-style operations over a JSON subtitle database: add records manually or from JSON, list records, delete by ID, export to Markdown/TXT, and search text. While 'subtitle management' is mentioned in trigger phrases, the actual code lacks the main advertised behaviors: it does not accept or process platform URLs, does not inspect local video files, and does not generate subtitles, summaries, or density assessments. Therefore the actual behavior is materially narrower and different in primary purpose from the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description says this skill should be used for subtitle extraction, video summarization, and information-density evaluation. However, the provided code only retrieves audio from supported online video URLs or local video files and returns metadata about the extracted audio file. While audio extraction could be a supporting preprocessing step for later transcription, that downstream functionality is not present in this code chunk. Therefore the actual behavior is materially narrower and different from the declared purpose, making this a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code substantially overlaps with the declared domain—processing video links from the named platforms and extracting available subtitles/metadata—but the description overstates functionality. In practice, the script is a video metadata/subtitle fetcher, not a summarizer or information-density analyzer. Bilibili subtitle extraction is implemented, while Douyin and Xiaohongshu only scrape metadata and explicitly state ASR would be needed for subtitles; YouTube metadata is fetched via yt-dlp, but subtitle retrieval is effectively unimplemented and returns an empty result with a warning. The declared support for local video files is absent entirely. Therefore, the description does not accurately represent the actual behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises and documents shell execution, network access, and local file read/write behavior, but it does not declare any explicit tool scope or permissions boundaries. In an agent environment, that increases the chance of over-broad invocation and unintended access to local files, downloaded media, cached subtitles, or external URLs without clear operator consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are extremely broad and overlap with ordinary conversation about videos, subtitles, or summaries, which raises the chance the skill activates unintentionally. Because the skill can download media, access local files, invoke shell tools, and write cache data, over-triggering can cause unexpected external requests or processing on inputs the user did not intend to hand to this skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill performs downloading, transcription, and local subtitle storage, yet the description lacks a clear user warning about media transfer and persistent retention. That creates a privacy and transparency risk because users may not realize remote content will be fetched, local files may be processed, and transcripts may remain on disk in a searchable cache.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the agent to conduct background investigations on authors and named individuals, which materially expands scope beyond transcription and summarization into profiling. In practice, that can drive unnecessary collection, inference, and presentation of personal or reputational information, especially when the subjects are private individuals or the model lacks reliable sourcing.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest describes a skill for handling Bilibili, Douyin, YouTube, Xiaohongshu, and local video files to extract subtitles, summarize content, and assess information density. This script's documented and actual behavior is much narrower: it extracts a BV ID, downloads Bilibili audio via yt-dlp, and reports file metadata, with no subtitle extraction, summarization, local file handling, or support for the other listed platforms.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/bilibili_audio.py (reported line 56)May include surrounding context.
python
"-o", audio_path, url_or_bvid, ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=300) if result.returncode != 0: # 尝试直接下载不转码 alt_cmd = [

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/frame_extractor.py (reported line 184)May include surrounding context.
python
"-o", audio_path, url_or_bvid, ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=300) if result.returncode != 0: # 尝试直接下载不转码 alt_cmd = [

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/pipeline.py (reported line 106)May include surrounding context.
python
"-o", audio_path, url_or_bvid, ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=300) if result.returncode != 0: # 尝试直接下载不转码 alt_cmd = [

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/pipeline.py (reported line 111)May include surrounding context.
python
"-o", audio_path, url_or_bvid, ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=300) if result.returncode != 0: # 尝试直接下载不转码 alt_cmd = [

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/video_audio.py (reported line 117)May include surrounding context.
python
"-o", audio_path, url_or_bvid, ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=300) if result.returncode != 0: # 尝试直接下载不转码 alt_cmd = [

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/video_audio.py (reported line 139)May include surrounding context.
python
"-o", audio_path, url_or_bvid, ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=300) if result.returncode != 0: # 尝试直接下载不转码 alt_cmd = [

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/video_audio.py (reported line 144)May include surrounding context.
python
"-o", audio_path, url_or_bvid, ] result = subprocess.run(cmd, capture_output=True, text=True, timeout=300) if result.returncode != 0: # 尝试直接下载不转码 alt_cmd = [

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/bilibili_audio.py (reported line 66)May include surrounding context.
python
"-o", audio_path, url_or_bvid, ] result = subprocess.run(alt_cmd, capture_output=True, text=True, timeout=300) if result.returncode != 0: print(f"[!] 下载失败: {result.stderr[-500:]}", file=sys.stderr) # 输出错误但继续

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/video_audio.py (reported line 127)May include surrounding context.
python
"-o", audio_path, url_or_bvid, ] result = subprocess.run(alt_cmd, capture_output=True, text=True, timeout=300) if result.returncode != 0: print(f"[!] 下载失败: {result.stderr[-500:]}", file=sys.stderr) # 输出错误但继续

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/bilibili_audio.py (reported line 83)May include surrounding context.
python
try: dur_cmd = [ffprobe, "-v", "quiet", "-show_entries", "format=duration", "-of", "csv=p=0", audio_path] dur_out = subprocess.run(dur_cmd, capture_output=True, text=True, timeout=10) info["duration_sec"] = round(float(dur_out.stdout.strip())) except Exception: pass

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/video_audio.py (reported line 195)May include surrounding context.
python
try: dur_cmd = [ffprobe, "-v", "quiet", "-show_entries", "format=duration", "-of", "csv=p=0", audio_path] dur_out = subprocess.run(dur_cmd, capture_output=True, text=True, timeout=10) info["duration_sec"] = round(float(dur_out.stdout.strip())) except Exception: pass

Static analysis

No suspicious patterns detected.