Skills/npm/ffmpeg-skill

ffmpeg-skill@3.2.3

CAUTION· startup only

Publisher claims: "Agent Skill that gives coding agents (Claude Code, Cursor, Codex) a local video editor: 42 FFmpeg tools with a machine-readable contract, contract-derived MCP server, FFmpeg capability detection, probe-first / verify-last workflow. Cut, join, silence remo" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher kajisho5 · publishing for 72 daysInstalls 29,120Last detonated 6d ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-08 and scored it 70/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Hidden zero-width characters detected; Hidden zero-width characters detected; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 20 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
20sprocessexec /app/apps/web/node_modules/.bin/ffmpeg
20sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/ffmpeg
20sprocessexec /app/node_modules/.bin/ffmpeg
20sprocessexec /pnpm/ffmpeg
20sprocessexec /usr/local/sbin/ffmpeg
20sprocessexec /usr/local/bin/ffmpeg
20sprocessexec /usr/sbin/ffmpeg
20sprocessexec /usr/bin/ffmpeg
20sprocessexec /sbin/ffmpeg
20sprocessexec /bin/ffmpeg
20sclaimedstartup only: exited (0) before answering · Ubuntu: sudo apt install ffmpeg Windows: winget install Gyan.FFmpeg installed Claude Code: /tmp/ks-detonate-LVfuC4/task/home/.claude/skills/ffmpeg-skill Done. Ask your agent things like "make this video 60 seconds and add captions".
20sprocessscript backend runs setup only
20sprocessno install scripts to re-run

Static findings

HIGH
Hidden zero-width characters detectedscripts/_common/emoji.py:32 · Hidden zero-width characters detected — may conceal content# (क्‍ष is ka + virama + ZWJ + ssa) and only becomes emoji glue *between two emoji bases*.Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Hidden zero-width characters detectedscripts/_common/emoji.py:70 · Hidden zero-width characters detected — may conceal contentand skin-tone modifiers kept together -- 👩‍💻 is one cluster, not three, and 1️⃣ starts at theFix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
HIGH
Privileged sudo commandbin/install.js:150 · Privileged sudo command — agent may execute with elevated privilegesconsole.warn(' Ubuntu: sudo apt install ffmpeg');Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/_common/alpha.py:126 · Python subprocess execution detectedchild = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, **_runner.child_kwargs())Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagebin/install.js:11 · npx invocation of non-well-known package — may execute untrusted code* npx ffmpeg-skill --all # all of the aboveFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/_common/fonts.py:459 · Python subprocess execution detectedproc = subprocess.run([exe, f":lang={FC_LANG[script]}:family={font_name}", "file"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagebin/install.js:9 · npx invocation of non-well-known package — may execute untrusted code* npx ffmpeg-skill --cursor # Cursor (~/.cursor/skills/ffmpeg-skill)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionscripts/_common/runner.py:342 · File type combined with upload action — agent may exfiltrate local data filesself.json = False # emit() prints a JSON document instead of the output pathFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/_common/fonts.py:93 · Python subprocess execution detectedproc = subprocess.run([exe, "--format=%{file}\n%{family}\n", font_name], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, encoding="utf-8", errors="replace", timeout=5)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/_common/runner.py:167 · Python subprocess execution detectedout = subprocess.run([found_exe("ffprobe"), "-version"], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, text=True, encoding="utf-8", errors="replace",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandscripts/_common/runner.py:27 · Privileged sudo command — agent may execute with elevated privileges" Arch: sudo pacman -S ffmpeg"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/_common/runner.py:25 · Privileged sudo command — agent may execute with elevated privileges" Debian/Ubuntu: sudo apt install ffmpeg\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagebin/install.js:10 · npx invocation of non-well-known package — may execute untrusted code* npx ffmpeg-skill --codex # Codex (~/.agents/skills/ffmpeg-skill)Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/_common/runner.py:1262 · Python subprocess execution detectedout = subprocess.run([safe_which("sysctl") or "/usr/sbin/sysctl", "-n", "hw.optional.arm64"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagebin/install.js:12 · npx invocation of non-well-known package — may execute untrusted code* npx ffmpeg-skill --dir ./skills # custom parent directoryFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Destructive file system command detectedscripts/probe.py:5 · Destructive file system command detectedcodecs, pixel format / color space, audio channels and sample rate.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/_common/emoji.py:244 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/_common/fonts.py:493 · Python subprocess execution detectedproc = subprocess.run([exe, "--format", "%{lang}\n", fonts_dir],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandscripts/_contract.py:1070 · Privileged sudo command — agent may execute with elevated privilegesreturn "your distribution's package update, e.g. sudo apt install --only-upgrade ffmpeg or sudo dnf upgrade ffmpeg"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/_common/runner.py:26 · Privileged sudo command — agent may execute with elevated privileges" Fedora: sudo dnf install ffmpeg\n"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/_common/runner.py:129 · Python subprocess execution detectedout = subprocess.run([found_exe("ffprobe"), "-version"], stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, text=True, encoding="utf-8", errors="replace",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/_common/asr.py:249 · Python subprocess execution detectedreturn subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, encoding="utf-8", errors="replace",Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/_common/runner.py:1509 · Python subprocess execution detectedchild = subprocess.Popen([sys.executable] + list(argv), stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, encoding="utf-8", errors="replace")Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Hidden zero-width characters detectedscripts/_common/emoji.py:75 · Hidden zero-width characters detected — may conceal contenta starter and never a tail on its own: `क्‍ष` (Hindi ka + virama + ZWJ + ssa) and `abc‍def`Fix: Keep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
AST07
MEDIUM
File type combined with upload actionscripts/_common/asr.py:939 · File type combined with upload action — agent may exfiltrate local data files# the JSON is looked for as <outdir>/audio.json: a host PARAKEET_OUTPUT_TEMPLATE would name it otherwiseFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commandscripts/_contract.py:1063 · Privileged sudo command — agent may execute with elevated privilegesreturn "sudo apt update && sudo apt install --only-upgrade ffmpeg"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/_common/emoji.py:218 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/_common/runner.py:401 · Process kill command — agent can terminate processeshelp=f"kill an ffmpeg run past this many seconds, kind=timeout (default {DEFAULT_TIMEOUT:.0f}; 0 = no limit)")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/_common/fonts.py:252 · Python subprocess execution detectedproc = subprocess.run([exe, "--format", "%{family[0]}", path], stdout=subprocess.PIPE,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/_common/drawtext.py:112 · Python subprocess execution detectedproc = subprocess.run([exe, "-hide_banner", flag], stdout=subprocess.PIPE,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/_common/runner.py:1471 · Python subprocess execution detectedproc = subprocess.run(list(cmd), stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=text, **text_kw, timeout=limit)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/_common/fonts.py:340 · Python subprocess execution detectedproc = subprocess.run([exe, f":lang={fc_lang}", "file", "family"],Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagebin/install.js:8 · npx invocation of non-well-known package — may execute untrusted code* npx ffmpeg-skill # Claude CodeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/_common/emoji.py:191 · Python subprocess execution detectedproc = subprocess.run([exe, f":family={family}", "file"], stdout=subprocess.PIPE,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/_contract.py:1254 · Python subprocess execution detectedproc = subprocess.run([exe, "--format=%{family}\n", font_name], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, encoding="utf-8", errors="replace", timeout=_DETECT_TIMEOUT)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/_contract.py:2053 · npx invocation of non-well-known package — may execute untrusted codeprint(f"ffmpeg-skill {d['version']} (this installed copy; re-run `npx ffmpeg-skill` to refresh it -- copies are not updated automatically)")Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/_contract.py:928 · Python subprocess execution detectedproc = subprocess.run([exe, "-hide_banner", flag], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, encoding="utf-8", errors="replace", timeout=_DETECT_TIMEOUT)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Unicode escape sequence detectedscripts/caption.py:834 · Unicode escape sequence detected — may contain obfuscated payloads"ar": "\u0627\u0644\u0639\u0631\u0628\u064a\u0629", "he": "\u05e2\u05d1\u05e8\u05d9\u05ea",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/caption.py:835 · Unicode escape sequence detected — may contain obfuscated payloads"hi": "\u0939\u093f\u0928\u094d\u0926\u0940", "th": "\u0e44\u0e17\u0e22",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/_contract.py:1288 · npx invocation of non-well-known package — may execute untrusted codeagainst the latest published release. A copy installed with `npx ffmpeg-skill` is not updatedFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/_contract.py:1217 · Python subprocess execution detectedproc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagescripts/_contract.py:1741 · npx invocation of non-well-known package — may execute untrusted code"replacement": "Python 3.10 or later; the npx installer skips an older interpreter and doctor reports it as unsupported (ok: false)"},Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/_contract.py:992 · Python subprocess execution detectedproc = subprocess.run([exe, "-version"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, encoding="utf-8", errors="replace", timeout=_DETECT_TIMEOUT)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/_contract.py:222 · File type combined with upload action — agent may exfiltrate local data files…act", deterministic=True), "render": dict(role="execution", inputs=["project.json (clips, transitions, captions, overlays, audio, loudness, export, check)", "media asset plus --template NAME (a shipped delivery template)"], outputs=["final…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedscripts/caption.py:832 · Unicode escape sequence detected — may contain obfuscated payloads"it": "Italiano", "nl": "Nederlands", "pl": "Polski", "ru": "\u0420\u0443\u0441\u0441\u043a\u0438\u0439",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
LOW
Refusal suppressionreferences/scripts.md:867 · Refusal suppression — attempting to prevent safety responses · informational: not an instruction file · informational: not an instruction fileTwo warnings never refuse or change the command: `short_segments: [{index, path, duration}]`Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionscripts/render.py:1160 · File type combined with upload action — agent may exfiltrate local data filesdie("give a project.json (or --init FILE, or --template NAME INPUT)")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedscripts/verify.py:116 · Python subprocess execution detectedproc = subprocess.run([sys.executable, str(HERE / argv[0])] + argv[1:] + ["--json"], stdout=subprocess.PIPE, stderr=subprocess.PIPE,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/_contract.py:225 · File type combined with upload action — agent may exfiltrate local data files…tic=True), "batch": dict(role="execution", inputs=["folder of media", "batch.json recipe (steps or a render project)"], outputs=["one artifact per input file in the recipe's output_dir (none for a steps recipe, not a render project, in whi…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/_contract.py:864 · npx invocation of non-well-known package — may execute untrusted code# frontmatter fails to load (GitHub's renderer reported it; npx skills add and ClaudeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/render.py:714 · Python subprocess execution detectedout = subprocess.run([found_exe("ffprobe"), "-version"], stdout=subprocess.PIPE,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
File type combined with upload actionscripts/silence.py:510 · File type combined with upload action — agent may exfiltrate local data filesdie(f"--timemap must end in .json or .csv: {args.timemap}", kind="input")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagescripts/_contract.py:1962 · npx invocation of non-well-known package — may execute untrusted code"requirements": {"python": ">=3.10 (standard library only)", "ffmpeg": ">=6.1", "ffprobe": ">=6.1", "node": ">=16 (npx installer only)"},Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detectedscripts/caption.py:837 · Unicode escape sequence detected — may contain obfuscated payloads"da": "Dansk", "no": "Norsk", "fi": "Suomi", "cs": "Cestina", "uk": "\u0423\u043a\u0440\u0430\u0457\u043d\u0441\u044c\u043a\u0430",Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07

Cost to the agent

Instructions loaded
≈4,111 tok
1 file · 80 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for ffmpeg-skill@3.2.3 as of 6d ago. This is the package itself, not its dependencies.

What would make this Verified

10 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim kajisho5: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Hidden zero-width characters detected≈ +4 on the totalKeep SKILL.md to visible, descriptive text. Remove comments and encoded text that address the agent.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim kajisho5Propose a patch to the maintainer