ClawHub
Back to skill

Security audit

Ai Video Remix

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed video-remix helper, but it asks users to clone and execute unpinned external code that was not included in the reviewed package.

Review before installing. Only run this if you trust the external GitHub repository at the time you clone it, and prefer a pinned commit or reviewed release. Use a local MP3 with --bgm to avoid YouTube access, provide only the minimum ShotAI and LLM credentials needed, and run it in a limited workspace because the downloaded runtime will process local video files.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/setup.md:63
Finding

Unpinned Remote Runtime Retrieval and Execution

Content
View full analysis

Vulnerability Details

File Location: references/setup.md:63-69 and references/setup.md:81-85
Vulnerability Type: Remote payload retrieval and supply-chain exposure
Risk Level: High

Vulnerable Code

bash
git clone https://github.com/abu-ShotAI/ai-video-remix.git
cd ai-video-editor
npm install
cp .env.example .env

The subsequently retrieved runtime is executed as follows:

bash
# Test skill (heuristic mode, no LLM needed)
AGENT_PROVIDER=none npx tsx src/skill/cli.ts "test run" --composition TravelVlog

Equivalent cloning, dependency installation, and runtime execution instructions also appear in SKILL.md:46-52.

Technical Analysis

The audited package is instruction-only and does not contain the runtime implementation it directs users to execute. Its setup procedure clones the mutable default branch of an external Git repository without pinning a reviewed commit hash or verified release artifact. It then runs npm install and executes the remotely obtained TypeScript CLI.

This creates a time-of-check/time-of-use trust gap: the code executed by a user can differ from the code that existed when this skill was reviewed. A repository compromise, malicious upstream change, or dependency compromise could therefore alter the effective payload after publication of the skill. In addition, npm install can execute package lifecycle scripts unless explicitly restricted.

Because neither the external runtime source nor its dependency lockfile is included in the audited artifact, the claims concerning localhost-only network binding, credential scoping, filesystem behavior, and external communication cannot be independently verified from this package.

The documented git clone command also names the repository ai-video-remix, while the next command enters ai-video-editor. This inconsistency may encourage users to improvise during installation, although it is primarily a reliability i ...[truncated 1399 chars]

Remediation
View remediation

Remediation Suggestions

  1. Bundle the reviewed runtime source in the skill package so its behavior can be audited together with the instructions.
  2. If remote retrieval remains necessary, pin the repository to a specific reviewed commit hash rather than cloning a mutable default branch.
  3. Publish signed or checksummed release archives and require users to verify their integrity before execution.
  4. Include a committed dependency lockfile and use npm ci rather than npm install to obtain deterministic dependency versions.
  5. Review dependency lifecycle scripts and use npm ci --ignore-scripts where installation scripts are not required.
  6. Pin CI and release dependencies, monitor them for known vulnerabilities, and apply automated dependency integrity checks.
  7. Correct the cloned directory name so the documented setup is deterministic.
  8. Avoid making definitive security claims about credential handling, network binding, or filesystem access unless the corresponding pinned runtime implementation is included in the audit scope.
  9. Recommend executing the runtime with least privilege, restricted filesystem access, and only the credentials needed for the current operation.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Configuration Reference

.env Variables

env
# ── LLM Agent (optional — set AGENT_PROVIDER=none to skip) ───────────────────

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/config.md (reported line 3)May include surrounding context.

Configuration Reference

.env Variables

env
# ── LLM Agent (optional — set AGENT_PROVIDER=none to skip) ───────────────────

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 69)May include surrounding context.

git clone https://github.com/abu-ShotAI/ai-video-remix.git cd ai-video-editor npm install cp .env.example .env

text

Edit `.env` with at minimum:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation advertises auto background music retrieval via yt-dlp but does not warn users that this may trigger outbound network access to third-party services and download external content. In the context of a skill presented as operating on a local video library, this can mislead users about privacy boundaries, create unexpected data exposure through requests/metadata, and introduce supply-chain or content-origin risk from externally fetched media.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description says to use the skill when the user asks to create a video remix, highlight reel, travel vlog, sports highlight, nature montage, or any styled video cut from their library, with examples like "create a sports highlight" and "generate a video with my footage." These phrases are broad everyday requests and the file does not provide exclusion conditions or negative examples to clearly bound when this skill should or should not activate.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Line L020 explicitly states that musicStyle must be English. This is a natural-language locale restriction in documentation, and the file does not offer a user choice or explain a region- or tool-specific necessity that would justify forcing English.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config.md (reported line 66)May include surrounding context.

DeepSeek (direct)

env
AGENT_PROVIDER=openai-compat
OPENAI_COMPAT_BASE_URL=https://api.deepseek.com/v1
OPENAI_COMPAT_API_KEY=sk-...
AGENT_MODEL=deepseek-chat

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The setup documentation adds yt-dlp-based YouTube music search/download functionality that is not disclosed in the skill manifest. Hidden or undocumented capability expands the skill's behavior beyond user expectations and can introduce legal, compliance, and supply-chain risk, especially because it pulls external media from the internet in a skill otherwise described as working from a local video library.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instructions tell users to install yt-dlp for downloading background music from YouTube but provide no warning about copyright, licensing, or terms-of-service implications. In this skill context, that omission is more dangerous because the feature is framed as a convenient content source for generated remixes, which may encourage improper use of copyrighted audio.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest describes the skill as generating remixes from a user's local video library using ShotAI, LLM planning, and Remotion rendering. README line L50 adds an extra capability, 'Auto background music' via yt-dlp, which goes beyond purely local-library remix generation and introduces external media acquisition not reflected in the stated scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The CLI option specifies '--lang <zh|en>' with 'default: zh', which establishes a language default in the documentation. Because the skill does not indicate that users are prompted for language preference or that the default is required for a region-specific use case, this can conflict with language/locale choice expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest describes remixing from a user's local video library in general terms, which implies direct use of local footage. However, the skill documentation later states it can only search and use videos that have been imported into a ShotAI collection and fully indexed first, so ordinary local files are not directly usable.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The manifest frames the skill as a local-library video remix tool using ShotAI, LLM planning, and Remotion rendering. The documentation adds an extra capability: optionally downloading background music from YouTube via yt-dlp, which is not mentioned in the manifest and is not an obvious requirement from the stated description alone.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The CLI option description states --lang <zh|en> with zh Chinese as the default, which imposes a language choice unless the user explicitly overrides it. This is a natural-language locale policy concern because the skill defaults to a specific language rather than matching user preference or prompting for choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation includes example API keys and tokens but does not explicitly warn users not to commit real secrets into version control or share populated .env files. In a skill that depends on multiple external services, this omission increases the chance of accidental secret exposure through copy-pasted configuration.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.