ClawHub
Back to skill

Security audit

libtv-skills

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent LibTV media-generation integration, but its download and upload helpers are too loosely scoped and could fetch, write, or upload more than users expect.

Review this skill before installing. It needs a LibTV access key and sends prompts, selected local media files, and session requests to the configured LibTV endpoint. Use it only with a trusted OPENAPI_IM_BASE/IM_BASE_URL, avoid arbitrary --urls and path-like --prefix values, and confirm any local file path before upload because the script's media and size checks are weak.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/download_results.py:31
Finding

Unrestricted URL Retrieval Enables SSRF and Local File Access

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/download_results.py:95
Finding

Output Path Traversal Through an Unsanitized Filename Prefix

Content
View full analysis
/../../outside/target_01.png ``` Operating-system path resolution permits the write to escape the intended output directory. Because the file is opened with mode `wb`, an existing writable file at the resulting path is truncated and replaced. The output directory itself is caller-controlled by design, but the documentation represents `--prefix` as a filename prefix rather than a secondary path-selection mechanism. Allowing separators in this field violates that boundary. ### Attack Path 1. A caller or agent invocation supplies a p ...[truncated 976 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/upload_file.py:25
Finding

Fail-Open Upload Validation Allows Non-Media and Oversized Files

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tainted flow: 'req' from os.environ.get (line 60, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/_common.py (reported line 46)May include surrounding context.

python
headers=_headers(),
    )
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        err_body = e.read().decode("utf-8") if e.fp else ""

Tainted flow: 'req' from os.environ.get (line 60, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/_common.py (reported line 62)May include surrounding context.

python
headers=_headers(),
    )
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        err_body = e.read().decode("utf-8") if e.fp else ""

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill instructs batch downloading generated media to the local filesystem, including direct URL-based downloads, but this local write behavior is not clearly surfaced in the top-level declared purpose. Hidden or under-declared file writes are dangerous because they can surprise users, persist untrusted remote content locally, and expand the blast radius from simple chat automation into disk-modifying behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill instructs batch downloading generated media to the local filesystem, including direct URL-based downloads, but this local write behavior is not clearly surfaced in the top-level declared purpose. Hidden or under-declared file writes are dangerous because they can surprise users, persist untrusted remote content locally, and expand the blast radius from simple chat automation into disk-modifying behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill instructs batch downloading generated media to the local filesystem, including direct URL-based downloads, but this local write behavior is not clearly surfaced in the top-level declared purpose. Hidden or under-declared file writes are dangerous because they can surprise users, persist untrusted remote content locally, and expand the blast radius from simple chat automation into disk-modifying behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill instructs batch downloading generated media to the local filesystem, including direct URL-based downloads, but this local write behavior is not clearly surfaced in the top-level declared purpose. Hidden or under-declared file writes are dangerous because they can surprise users, persist untrusted remote content locally, and expand the blast radius from simple chat automation into disk-modifying behavior.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill instructs batch downloading generated media to the local filesystem, including direct URL-based downloads, but this local write behavior is not clearly surfaced in the top-level declared purpose. Hidden or under-declared file writes are dangerous because they can surprise users, persist untrusted remote content locally, and expand the blast radius from simple chat automation into disk-modifying behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The activation rule is extremely broad and mandates triggering for nearly any AI image/video-related request, including loosely related mentions like uploads or progress checks. Over-broad triggering is dangerous because it can cause the agent to invoke networked actions, file uploads, session creation, or downstream processing in situations where the user did not clearly intend to use this external service, leading to privacy leaks, unnecessary external data transfer, and loss of user control.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill requires environment access, network access, and likely additional execution capabilities, but does not declare an explicit tool scope such as allowed-tools or permissions. This weakens containment and review because the runtime can perform sensitive actions without a clearly bounded capability contract, increasing the chance of unintended data access or outbound requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs automatic downloading of generated results to local storage without explicit user warning or consent at the moment of write. Automatic disk writes are risky because they persist potentially untrusted content, may consume storage, and can violate user expectations or policy in environments where filesystem writes require explicit approval.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This script exposes project-switching functionality that is not described by the skill's manifest, which states the skill is for AI image/video generation and editing workflows. Hidden or undocumented state-changing capabilities can let the skill alter the user's active project context unexpectedly, increasing the risk of cross-project confusion, unauthorized actions in the wrong workspace, or abuse if the agent invokes it without clear user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The module docstring and CLI help text are entirely in Chinese, which imposes a specific language on users without opt-in or explanation. Under the stated policy, hardcoded locale/language constraints should either offer user choice or be clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The docstring, CLI description, examples, and help text are presented only in Chinese. The policy for this audit flags language/locale constraints when a skill forces a specific language without user opt-in, and this file does not offer an alternative language or explain that it is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring is entirely in Chinese and the command-line help text throughout the script is also Chinese-only, which imposes a specific language on users. The policy allows locale constraints only when they are optional, user-selected, or clearly justified as region-specific, none of which is stated here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The script performs a network-backed session query via query_session(...), and the help text indicates it uses the LIBTV_ACCESS_KEY bearer credential. While the CLI describes required environment variables, it does not explicitly warn the user that the command will transmit authentication and request data to a remote service when run.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.