ClawHub
Back to skill

Security audit

Video Search test

Security checks for vulnerabilities and agentic risk

Overview

This video search skill can work as advertised, but it also silently creates or reuses an identity, stores tokens locally, and sends videos and account-linked requests to an external service with limited user control.

Install only if you trust the lifeemergence.com service and are comfortable with video files or URLs being sent to it, report history being fetched from the cloud, and local identity/token data being stored in the workspace. Before use, confirm retention, token protection, account creation behavior, and whether silent identity reuse and history lookup can be disabled.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            if offset:
                query = query.offset(offset)
Confidence
69% confidence
Finding
Here, filter keys come from the caller-provided filters dict and are passed into getattr(self.__model__, key) without validation. While this is not SQL injection because SQLAlchemy still parameterizes values, it can expose unintended model attributes, trigger errors/DoS via invalid keys, and enable unauthorized querying on sensitive columns if higher layers pass user-controlled filters through.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Content
if filters:
                for key, value in filters.items():
                    query = query.filter(getattr(self.__model__, key) == value)

            return query.scalar()
        finally:
Confidence
69% confidence
Finding
The count() method has the same unvalidated dynamic attribute lookup on caller-supplied filter keys. In a skill context that already persists user records, this broadens the attack surface for unauthorized enumeration of user metadata and can cause avoidable exceptions if unexpected fields are supplied.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises no explicit permissions, yet the documented behavior clearly requires shell execution, network access, local file reads/writes, and environment usage. This mismatch prevents informed review and consent, and can hide sensitive operations such as local file persistence and backend communication.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill claims to do video search, but its documented workflow also includes historical report enumeration, implicit user identity handling, and generic backend analysis/polling. This is a material behavior expansion beyond the stated purpose and can expose user data or account context in ways a user would not reasonably expect from a search skill.

Description-Behavior Mismatch

Medium
Confidence
83% confidence
Finding
This DAO initializes and manages a shared SQLite database with path redirection logic that spans agent workspaces, which is materially broader than a video-search skill's declared purpose. Such hidden persistence and cross-skill data placement increases privacy and data-boundary risks, especially when user data is stored in a common workspace-level database.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The module implements broad CRUD capabilities, including update and delete operations on user records, which exceed the stated purpose of intelligent video search. Excess capability is dangerous because it creates opportunities for unneeded collection, modification, or destruction of user data if this code is reachable through the skill.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Defining a persistent User model with fields such as username, realname, email, birthday, token, and open_token introduces storage of personally identifiable and credential-like data not justified by the declared video retrieval use case. In this context, collecting and persisting such fields is more dangerous because it is unrelated to the advertised function and may surprise users or downstream operators.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
This utility implements identity discovery, fallback account generation, local persistence, and current-user resolution even though the declared skill purpose is video search/analysis. That is dangerous because it silently expands the skill's authority to manage user identity state and can cause unexpected account creation or reuse of local identities without clear user consent.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The generic HTTP helper automatically provisions or logs in a user, loads and persists tokens, and then attaches authentication headers to outbound requests. In a video-search skill this is overbroad and risky because a seemingly simple request path can silently create accounts, exfiltrate identity data to external services, and reuse stored credentials for unrelated network actions.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code reads an identity value from workspace data/smyx-api-key.txt to derive the current open-id, which is unrelated to the stated video-search scope. This creates an unexpected trust path from local workspace secrets into runtime identity selection and can cause silent impersonation or unintended use of a local credential.

Context-Inappropriate Capability

High
Confidence
97% confidence
Finding
This code creates a default user identifier, looks up existing local users, and persists newly created user records to a local database. That grants the skill account-management capability outside its advertised function and can leave durable identity artifacts and tokens on disk without user awareness.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The default trigger condition is broad enough to activate on many ordinary requests about finding content in videos. Overbroad activation can cause unintended processing of attachments or queries, leading to unnecessary local persistence or remote submission of potentially sensitive media.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The history-report trigger relies on broad keyword matching and automatically calls a cloud API for records associated with the current identity. This can expose account-linked report metadata without clear confirmation, especially when user phrasing is ambiguous or exploratory.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill states that uploaded attachments are automatically saved locally, but does not present this as a clear privacy/safety warning to users. Silent local persistence of user media increases risk of accidental retention, secondary access, or misuse of sensitive files.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation does not clearly warn users that URLs and history-report requests are transmitted to cloud APIs. Sending media references and account-linked query data off-device without conspicuous disclosure creates privacy and data-governance risk.

Natural-Language Policy Violations

High
Confidence
95% confidence
Finding
The skill mandates automatic reuse or creation of a local default user identity when no upstream identity is provided, without user opt-in. Implicit identity creation and account association can lead to unauthorized linkage of reports, privacy violations, and unexpected backend actions under a synthetic or reused identity.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The code reads the entire local file and sends it to an analysis service without any visible consent, disclosure, or trust-boundary warning in this skill. In a video-analysis context, uploaded content may contain sensitive footage, faces, locations, or regulated data, so silent transmission can cause privacy and compliance violations even if the backend is legitimate.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The code reads a workspace API-key-related file and uses its contents as identity material without any user-facing disclosure. Even if intended for convenience, silently repurposing local secret material for identity selection undermines transparency and can violate least surprise and least privilege.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The helper sends an automatic login/registration request containing openId, mobile, and source fields to an external endpoint with no user-facing warning. This is dangerous because it transmits identity data off-host and may create or bind an account implicitly, which is especially mismatched for a video-search skill.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
This generic request helper automatically attaches authentication headers and request data to outbound network requests without a user-facing disclosure of the destination or credentials in use. In the context of a video-search skill, that hidden behavior increases the risk of unintended data sharing and credential misuse across different API calls.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
95% confidence
Finding
The requests.post call transmits identity-related fields to an external service, constituting real external data transmission. On its own external I/O is not always a flaw, but here it is coupled with silent login/registration behavior and hidden identity sourcing, making the transmission security-relevant and inappropriate for the stated skill scope.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2