ClawHub
Back to skill

Security audit

Video Search test

Security checks for vulnerabilities and agentic risk

Overview

This video search skill can send videos to a remote service and also silently creates or reuses an account identity, stores tokens, and retrieves cloud history, so it needs review before installation.

Install only if you trust the publisher and are comfortable with videos or video URLs being sent to lifeemergence.com services, an internal identity being created or reused automatically, tokens being stored locally, and cloud history reports being fetched under that identity. Avoid using it with sensitive local media or private/internal URLs unless those data flows are acceptable.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
74% confidence
Finding
Here getattr(self.__model__, key) uses keys from the caller-supplied filters dict, so an attacker controlling filter names can access unintended mapped attributes and influence query construction. While SQLAlchemy prevents classic SQL injection here, this pattern enables unvalidated field selection and can expose or query on columns the caller should not control, which is risky in a generic persistence layer.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
74% confidence
Finding
The count() method repeats the same unvalidated dynamic column selection from caller-controlled filter keys. Even without raw SQL injection, this can let untrusted callers probe sensitive columns or trigger unintended query behavior, increasing information disclosure and misuse risk.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill advertises and instructs use of capabilities including shell execution, network access, local file read/write, and environment use, but does not declare permissions or constraints for them. This creates a trust and review gap: operators may invoke a skill with powerful side effects without clear authorization boundaries, increasing the chance of unintended data access, command execution, or exfiltration.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
This file exposes broad generic network capabilities including arbitrary http_get/http_post/http_put/http_delete methods and CRUD-style wrappers that are not constrained to video-search functionality. In an agent skill, this materially expands the attack surface because downstream prompts or tool calls could repurpose the skill as a general-purpose HTTP client to access or modify remote systems outside the declared scope.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The add, edit, and delete methods provide remote state-changing operations, but the declared skill purpose is video search and analysis, which is primarily read-oriented. In the context of an agent-accessible skill, unjustified mutation primitives can be abused to alter or delete remote data if the agent is induced to call them, making the mismatch between capability and stated purpose security-relevant.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
This file implements local user/account persistence in a skill described as video search/analysis, which is a notable scope mismatch. Unrelated identity storage broadens the data footprint and attack surface, especially because it persists usernames, real names, emails, birthdays, and tokens without any evident need tied to video retrieval.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The DAO performs persistent SQLite writes and automatic schema migration, capabilities that exceed the stated video search/analysis purpose. In skill ecosystems, hidden persistence is dangerous because it can silently retain data across runs, expand blast radius, and create privacy and integrity risks inconsistent with user expectations.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The utility layer performs identity resolution, automatic login/account bootstrap, token acquisition, and local persistence even though the declared skill is for video search/analysis. This broadens the skill's privilege and data-handling scope, creating an unexpected account linkage and network side effect that users would not reasonably expect from a video retrieval skill.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The code reads identity-like data from workspace files and stores or reuses open-id values across the agent workspace, which is unrelated to core video-search functionality. This creates privacy and boundary concerns because identities may be inherited or persisted across contexts without clear isolation or disclosure.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The default trigger condition is overly broad: it says the skill should automatically run whenever a user needs to search for specific content in video. Broad auto-invocation can cause the agent to process attachments, URLs, or local files without sufficiently specific intent, increasing the risk of accidental data handling and unexpected external/API calls.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The history report feature auto-triggers on broad, everyday phrases like viewing history or report lists, then mandates a cloud API query. This can cause unintended retrieval of prior reports tied to an internally managed identity, potentially exposing sensitive historical analysis data without strong user verification or intent confirmation.

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The script initializes an internal identity via OpenIdUtil.resolve_current_open_id using a hidden CLI parameter and without clear user-facing notice. In an agent skill context, hidden identity resolution can cause requests and result listing to execute under an unexpected account context, risking privacy leakage or cross-user access if downstream controls are weak.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
When a local path is supplied, the skill reads the entire file and sends it to a remote analysis API without any explicit user-facing disclosure, consent step, or in-code safeguard limiting sensitive uploads. In an agent setting, this can lead to unintentional exfiltration of local video contents or embedded sensitive metadata to an external service.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The script accepts a hidden --api-key parameter and suppresses it from help output, giving users and auditors less visibility into credential use. Even though this file does not itself transmit the key, hidden credential parameters encourage opaque handling and can lead to accidental exposure through shell history, process listings, or undisclosed downstream network use.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The tool tells the user it is 'analyzing video' and passes a user-supplied local path or URL into backend-driven analysis via skill.get_output_analysis without explicit disclosure that the content or reference may be sent to a remote service. In a skill context handling video inputs, this increases privacy and data-governance risk because users may provide sensitive local media or internal URLs without realizing they are leaving the local environment.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The HTTP helper automatically attaches usernames, tokens, API keys, tenant metadata, and skill platform identifiers to outbound requests without visible user disclosure in this file. Even if sent over HTTPS, this is a transparency and least-privilege problem because a video-search skill should not silently expand the set of identity and telemetry fields transmitted.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The helper silently calls a remote phoneLogin endpoint with silent/register enabled and sends openId/mobile values derived from local state. Automatic account creation or login without clear user awareness is risky because it can register identities with a third-party service and establish persistent tokens unexpectedly.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The skill reads an identity value from a local credential-like file (data/smyx-api-key.txt) without any visible disclosure or validation of user intent in this file. While local file reads are not exfiltration by themselves, here the value is later used to derive identity for remote requests, making the hidden read security-relevant.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
This line transmits identity-bearing data to an external service via requests.post(), including openId/mobile and registration flags. In the context of a video-search skill, this outbound transmission is more concerning because it is not obviously necessary for the advertised functionality and can create or link remote accounts behind the user's back.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2