Skills
skills/gooseworks-ai/gooseworks-ads-skills/add-captions-klap/Gen Agent Trust Hub

add-captions-klap

Fail

Audited by Gen Agent Trust Hub on Jul 10, 2026

Risk Level: HIGHDATA_EXFILTRATIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [DATA_EXFILTRATION]: The skill exposes user content by uploading video files to public anonymous file-hosting services.
  • scripts/klap_caption.py contains functions catbox_upload and tmpfiles_upload that send local files to public web endpoints.
  • The host_input function in scripts/klap_caption.py uses these anonymous hosts by default when no source_url is provided.
  • [EXTERNAL_DOWNLOADS]: Automated scanners identified a malicious URL within the skill's code.
  • The endpoint https://tmpfiles.org/api/v1/upload used in scripts/klap_caption.py was flagged by the URLite scanner as associated with botnet activity.
  • [COMMAND_EXECUTION]: The skill performs shell command execution using local system tools.
  • scripts/klap_caption.py executes ffprobe to determine video dimensions using user-provided input paths.
  • scripts/make_klap_style_subs.py executes ffmpeg to burn subtitles into video files, incorporating file paths directly into the command string.
  • These subprocess calls rely on paths derived from user input without explicit sanitization, which can be a vector for command injection.
Recommendations
  • AI detected serious security threats
  • Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 10, 2026, 03:06 PM
Security Audit — agent-trust-hub — add-captions-klap