fix: the audit's high findings (captions, timing, audio, colour, batch), MCP argument safety, and Scorecard hardening

.clusterfuzzlite/Dockerfile

@@ -0,0 +1,6 @@
+# ClusterFuzzLite build image. The base is pinned by digest (Scorecard Pinned-Dependencies) and
+# already carries atheris and PyInstaller; nothing is installed from a package index here.
+FROM gcr.io/oss-fuzz-base/base-builder-python@sha256:21f6fab17ace4dc76e1c56de91ee95d3d03da021df94b41056ba036f6c6f55e9
+COPY . $SRC/ffmpeg-skill
+WORKDIR $SRC/ffmpeg-skill
+COPY .clusterfuzzlite/build.sh $SRC/

.clusterfuzzlite/build.sh

@@ -0,0 +1,11 @@
+#!/bin/bash -eu
+# Build every fuzz/*_fuzzer.py into a standalone fuzzer. scripts/ is added to the bundle's import
+# path so `_common` resolves inside the PyInstaller build exactly as it does from the checkout.
+for fuzzer in "$SRC"/ffmpeg-skill/fuzz/*_fuzzer.py; do
+  compile_python_fuzzer "$fuzzer" --paths "$SRC/ffmpeg-skill/scripts" --paths "$SRC/ffmpeg-skill/fuzz"
+  name=$(basename "$fuzzer" .py)
+  seeds="$SRC/ffmpeg-skill/fuzz/seeds/${name%_fuzzer}"
+  if [ -d "$seeds" ]; then
+    (cd "$seeds" && zip -q -r "$OUT/${name}_seed_corpus.zip" .)
+  fi
+done

.clusterfuzzlite/project.yaml

@@ -0,0 +1 @@
+language: python

.github/dependabot.yml

@@ -1,4 +1,5 @@
-# Keeps GitHub Actions pins (actions/checkout@v4, release-drafter@v6, etc.) and package.json's
+# Keeps GitHub Actions pins (each `uses:` is a commit SHA with its tag in a comment; Dependabot
+# updates both) and package.json's
 # npm metadata current, opening a PR for each update instead of letting either go stale silently.
 # There's no requirements.txt/pyproject.toml to watch here -- scripts/ is deliberately Python
 # 3.10+ standard library only, no third-party runtime dependencies (see README).

.github/scripts/publish_plugin_branch.sh

@@ -113,7 +113,7 @@ README, the changelog and the tests are in the repository: https://github.com/ka
 
 Needs FFmpeg 6.1 or later and Python 3.10 or later. The tools themselves open no network
 connection and read no API key. The one exception is transcription (`caption.py --transcribe`,
-`silence.py --filler --transcribe`), which runs a speech engine you installed yourself
+`silence.py --transcribe` with `--filler` or a sentence flag), which runs a speech engine you installed yourself
 (whisper.cpp, faster-whisper, openai-whisper or parakeet): on its first run such an engine may
 download its model, and a Hugging Face client uses a token you are logged in with.
 PLUGIN_README

.github/workflows/cflite.yml

@@ -0,0 +1,42 @@
+# ClusterFuzzLite: build the fuzz/ targets and fuzz them for a few minutes on each pull request
+# that touches Python, and longer once a week (Scorecard Fuzzing). Each target documents what it
+# accepts as a refusal; anything else is a crash and fails the job.
+# https://google.github.io/clusterfuzzlite/running-clusterfuzzlite/github-actions/
+name: ClusterFuzzLite
+on:
+  pull_request:
+    paths:
+      - "scripts/**.py"
+      - "fuzz/**"
+      - ".clusterfuzzlite/**"
+      - ".github/workflows/cflite.yml"
+  schedule:
+    - cron: '17 3 * * 2'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  fuzz:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Build fuzzers
+        id: build
+        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          language: python
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          sanitizer: address
+      - name: Run fuzzers
+        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          fuzz-seconds: ${{ github.event_name == 'schedule' && 1800 || 300 }}
+          mode: ${{ github.event_name == 'pull_request' && 'code-change' || 'batch' }}
+          sanitizer: address
+          output-sarif: false

.github/workflows/ci.yml

@@ -47,14 +47,15 @@ jobs:
     runs-on: ${{ matrix.python == '3.10' && startsWith(matrix.os, 'ubuntu') && 'ubuntu-24.04' || matrix.os }}
     name: test (${{ matrix.os }}, py${{ matrix.python }}, ${{ matrix.part }}/3)
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           # Full history (not the default shallow depth-1 clone): test_contract.py's
           # test_changelog_mentions_every_closed_issue_since_last_tag walks git log back to the
           # latest tag to check CHANGELOG.md against "Closes #N" in commit bodies -- a shallow
           # clone would make that check silently a no-op (no tag reachable to diff against).
           fetch-depth: 0
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: ${{ matrix.python }}
       - name: Install ffmpeg (Linux)
@@ -106,7 +107,7 @@ jobs:
           # that is reported, not hidden, but the listings must still be uploaded
           python scripts/_contract.py doctor --json > listings/doctor.json || echo "doctor exit $?"
           cat listings/doctor.json
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: ffmpeg-listings-${{ matrix.os }}-py${{ matrix.python }}-${{ matrix.part }}
@@ -139,8 +140,9 @@ jobs:
           apt-get update -qq
           DEBIAN_FRONTEND=noninteractive apt-get install -y -qq ffmpeg python3 fonts-dejavu-core git nodejs ca-certificates
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: ffmpeg version, listings and doctor
         run: |
@@ -152,7 +154,7 @@ jobs:
           ffmpeg -hide_banner -bsfs > listings/ffmpeg_bsfs.txt
           python3 scripts/_contract.py doctor --json > listings/doctor.json || echo "doctor exit $?"
           cat listings/doctor.json
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: ffmpeg-listings-debian-trixie-ffmpeg7-${{ matrix.part }}

.github/workflows/codeql.yml

@@ -19,24 +19,30 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+# Read-only at the top; the one write the analysis needs is granted to its job (Scorecard
+# Token-Permissions).
 permissions:
   contents: read
-  security-events: write
 
 jobs:
   analyze:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write   # upload the SARIF to code scanning
     strategy:
       fail-fast: false
       matrix:
         language: [python, javascript]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
-      - uses: github/codeql-action/init@v4
+      - uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           languages: ${{ matrix.language }}
 
-      - uses: github/codeql-action/analyze@v4
+      - uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           category: "/language:${{ matrix.language }}"

.github/workflows/dependabot-auto-merge.yml

@@ -11,17 +11,19 @@ on:
     types: [opened, reopened, synchronize]
 
 permissions:
-  contents: write
-  pull-requests: write
+  contents: read
 
 jobs:
   auto-merge:
     if: github.actor == 'dependabot[bot]'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write        # enable auto-merge
+      pull-requests: write   # approve the PR
     steps:
       - name: Fetch Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v3
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/pages.yml

@@ -20,8 +20,6 @@ on:
 
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 concurrency:
   group: pages
@@ -31,22 +29,27 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Assemble the site
         run: python3 .github/scripts/build_pages.py _pages
-      - uses: actions/configure-pages@v6
-      - uses: actions/jekyll-build-pages@v1
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
+      - uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 # v1.0.13
         with:
           source: _pages
           destination: _site
-      - uses: actions/upload-pages-artifact@v5
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
 
   deploy:
     needs: build
     runs-on: ubuntu-latest
+    permissions:
+      pages: write      # publish the artifact
+      id-token: write   # verify the deployment's origin
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/release-drafter.yml

@@ -34,7 +34,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: release-drafter/release-drafter@v7
+      - uses: release-drafter/release-drafter@978bb0b30c5ee8cdd332ced253758157150d43f0 # v7.10.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -48,6 +48,6 @@ jobs:
       # The dedicated autolabeler sub-action (not the main release-drafter action used above) --
       # applies just the `autolabeler` rules from release-drafter.yml to this PR, with nothing
       # else running (no draft-release read/write against a PR ref that isn't main).
-      - uses: release-drafter/release-drafter/autolabeler@v7
+      - uses: release-drafter/release-drafter/autolabeler@978bb0b30c5ee8cdd332ced253758157150d43f0 # v7.10.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -59,15 +59,17 @@ concurrency:
   cancel-in-progress: false
 
 permissions:
-  contents: write
-  pull-requests: read   # resolve_version.py reads merged PRs' labels through gh api
-  id-token: write        # required for `npm publish --provenance`
+  contents: read
 
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write        # bump commit, tag, GitHub release, plugin branch
+      pull-requests: read    # resolve_version.py reads merged PRs' labels through gh api
+      id-token: write        # required for `npm publish --provenance`
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # The tip of main, not the SHA that triggered this run: with two merges in quick
           # succession the concurrency group queues the second run, and the first must bump on
@@ -266,14 +268,14 @@ jobs:
 
       - name: Create tag and GitHub Release
         if: steps.check.outputs.already_released == 'false'
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@8a0cd651e5b2365bd640854a3fa5dfc70e4875f3 # v3.0.4
         with:
           tag_name: ${{ steps.check.outputs.tag }}
           target_commitish: ${{ steps.check.outputs.sha }}
           body_path: release_notes.md
           generate_release_notes: true
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         if: steps.check.outputs.already_released == 'false'
         with:
           node-version: "20"