ClawTV

• Outcome: Review
• Latest audit: May 28, 2026 · 1:24 PM UTC
• Version: 1.0.2

Overview

ClawTV is a transparent Apple TV automation skill, but it needs review because it stores media-control credentials locally and uses broad macOS automation with a real script-injection weakness.

Install only if you are comfortable giving this script control of your Apple TV and optional Plex server, and with AI mode sending TV screenshots and goals to Anthropic. Use a budget-limited Anthropic key, avoid AI mode on account or billing screens, delete old screenshots, manually restrict ~/.clawtv/config.json permissions, and be cautious pairing with devices whose names you do not control.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

end tell
    return false
    '''
    result = subprocess.run(["osascript", "-e", script], capture_output=True, text=True)
    if result.returncode != 0:
        print(f"QuickTime setup failed: {result.stderr}")
        return False

• Confidence: 96% confidence
• Finding: This AppleScript is built with direct string interpolation of the Apple TV name (`atv_name`) into the script source, then executed via `osascript`. If a device name contains quotes or AppleScript syntax, a local network attacker controlling a spoofed Apple TV advertisement or a maliciously renamed device could inject arbitrary AppleScript commands on the Mac, leading to local code execution or UI automation abuse.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill appears to use powerful capabilities including environment access, file read/write, network access, and shell execution without declaring corresponding permissions. That undermines user review and sandbox expectations, and can conceal sensitive operations such as credential access, local file manipulation, or command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared purpose describes a remote-control skill, but the detected behavior includes broader local-network discovery, cloud-linked Plex resource access, direct app launching, text entry, playback metadata access, and desktop automation through AppleScript/System Events. This mismatch is dangerous because it masks a much larger attack surface and could let the skill interact with local devices, accounts, and host applications in ways a user would not reasonably expect.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill sends user goals and screenshots to Anthropic and reads an API key from the environment, but this external data flow is not clearly justified by the manifest description. In a skill context controlling a TV, hidden third-party transmission of screen content materially increases privacy risk because screenshots may contain personal viewing history, account names, or other sensitive on-screen data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly states that screenshots of the Apple TV are sent to Claude's vision API, but it does not clearly warn users that those screenshots may contain sensitive on-screen data such as account names, email addresses, search history, recommendations, billing/account settings, or other private content. In a tool designed to autonomously inspect arbitrary TV app screens, this omission creates a real privacy risk because users may unknowingly transmit personal or regulated content to a third-party AI service.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Apple TV screenshots are base64-encoded and sent to Anthropic in the vision loop without an explicit consent gate or prominent warning at the moment of transmission. In this skill's context, screen captures can expose entertainment choices, search queries, profiles, subscription data, and potentially sensitive QR codes or account information, making the undisclosed exfiltration a meaningful privacy vulnerability.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: Plex playback requests are sent to Anthropic for intent parsing without clear disclosure to the user. Although less sensitive than screenshots, media requests can still reveal personal preferences and viewing habits, so silently transmitting them to a third party is a privacy issue.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyatv>=0.15.0
anthropic>=0.40.0
plexapi>=4.15.0
pyobjc-framework-Quartz>=10.0  # optional: QuickTime screenshot method

• Confidence: 95% confidence
• Finding: The dependency is specified with a lower bound only, which allows installation of any newer version, including unreviewed major releases or compromised packages. This weakens supply-chain control and can lead to unexpected vulnerable or breaking versions being pulled into the skill environment.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyatv>=0.15.0
anthropic>=0.40.0
plexapi>=4.15.0
pyobjc-framework-Quartz>=10.0  # optional: QuickTime screenshot method

• Confidence: 98% confidence
• Finding: The anthropic package is not pinned and is also separately flagged as having known advisories, so allowing any version >=0.40.0 increases the chance of resolving to a vulnerable release. In an agent skill that may process local data and interact with tools, dependency drift materially increases supply-chain and runtime risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pyatv>=0.15.0
anthropic>=0.40.0
plexapi>=4.15.0
pyobjc-framework-Quartz>=10.0  # optional: QuickTime screenshot method

• Confidence: 94% confidence
• Finding: Using an unpinned plexapi dependency permits uncontrolled upgrades, which can introduce security issues or incompatible behavior without code changes. This is a classic supply-chain hygiene problem even if no specific advisory is cited here.

Known Vulnerable Dependency: anthropic — 2 advisory(ies): CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox)

Low

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The requirements include anthropic, and the static analysis reports known advisories affecting that dependency, including insecure default file permissions and a path validation race condition. In the context of an autonomous TV-control skill with vision and possible local filesystem interaction, these issues could expose local data or weaken sandbox boundaries, making the dependency materially riskier than in a purely stateless integration.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.