ClawHub
Back to skill

Security audit

Video Director

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it quietly adds a default promotional ending to generated videos unless overridden.

Review generated storyboards before rendering or publishing. In particular, remove or override the default ending scene if you do not want clawhub.ai promotional text in the final video; otherwise the skill appears limited to local storyboard generation without credential, network, or persistence behavior.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
scripts/plan.js:512
Finding

Undisclosed Hard-Coded Promotional Content Injection

Content
View full analysis

Vulnerability Details

File Location: scripts/plan.js, lines 512-542
Vulnerability Type: Undisclosed default promotional output injection
Risk Level: Medium

Vulnerable Code

js
scenes.push({
  id: scenes.length,
  type: '结尾',
  timeStart: currentTime,
  timeEnd: currentTime + 3,
  duration: 3,
  title: options.ending?.endingTitle || '开始使用',
  script: options.ending?.endingText || '更多信息，请访问 clawhub.ai',
  visual: {
    layout: 'center-focus',
    elements: [
      { type: 'emoji', value: '🔧', anim: 'popIn', delay: 10, duration: 15 },
      {
        type: '文字',
        value: options.ending?.endingText || 'clawhub.ai',
        anim: 'fadeSlideUp',
        delay: 25,
        duration: 40,
        style: {
          fontSize: 64,
          color: '#FFD700',
          fontWeight: '900'
        }
      },
      {
        type: '描述',
        value: options.ending?.endingDesc || '解锁你的第一个AI技能',
        anim: 'fadeSlideUp',
        delay: 45,
        duration: 40,
        style: {
          fontSize: 36,
          color: '#9ca3af'
        }
      }
    ]
  }
});

Technical Analysis

The planScenes() function unconditionally appends a closing scene to every generated storyboard. When the caller does not explicitly provide endingTitle, endingText, and endingDesc, the function inserts a fixed advertisement and external-domain call to action for clawhub.ai.

This behavior is not disclosed by the skill documentation as a mandatory or default branding feature. Consequently, ordinary use of the documented interface can alter the requested output by adding unrelated promotional content. Because the generated storyboard is intended for consumption by a downstream video producer, the injected content may be rendered directly into published videos.

The code does not make a network request to the referenced domain, execute external code, collec ...[truncated 1371 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the hard-coded clawhub.ai domain and promotional fallback messages.
  2. Append a closing scene only when the caller explicitly supplies an ending or requests a call-to-action scene.
  3. If a default ending is required, use neutral, topic-derived content that does not promote an external service.
  4. Document all optional branding behavior and require explicit user opt-in before adding it.
  5. Separate branding configuration from storyboard generation and default the configuration to disabled.
  6. Add automated tests confirming that no external domain or promotional message appears when no ending is provided.
  7. Validate user-supplied ending fields before passing generated content to downstream renderers.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description is entirely Chinese-specific and later technical notes require Chinese font support and estimate timing by Chinese character rate, indicating the skill is designed around a fixed language/locale. The file does not offer a language choice or state that the skill is intentionally limited to a Chinese-only regional use case.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation condition is broad enough to trigger on generic requests about video content or planning, which can cause the skill to run outside its intended niche. Over-broad activation increases the chance of incorrect tool selection, unexpected behavior, and unintended downstream processing by connected skills such as video-producer.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code file includes natural-language descriptions and user-facing usage text only in Chinese, such as the header comments and command-line help. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation when no alternative language choice or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script emits operational logs and CLI usage/help messages only in Chinese, including startup, completion, and save-status messages. Because these are user-visible strings and the file does not offer locale selection or explain a region-specific scope, they violate the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a skill for converting text into high-attraction storyboard JSON for short educational videos, but the code always appends a hard-coded ending scene promoting clawhub.ai and '解锁你的第一个AI技能' unless overridden. This goes beyond neutral scene planning and injects product marketing behavior not stated in the skill description.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The header comment presents the script as a straightforward planner from topic and key points to standard JSON storyboard data. In practice, the implementation injects a default branded closing scene with external-site messaging, which contradicts the implied neutral transformation behavior in the documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.