ClawHub
Back to skill

Security audit

Instagram Reels

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward, disclosed reel transcription workflow with privacy and temp-file hygiene risks but no hidden or purpose-mismatched behavior.

Install only in a dedicated environment, avoid using exported browser cookies unless necessary, do not process private or sensitive media unless you are comfortable sending the audio to Groq, and prefer a unique private temp directory instead of the documented fixed /tmp paths.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Unpinned Third-Party Package Installation

Content
View full analysis
Remediation
View remediation
" ``` - Publish a lock file or requirements file containing cryptographic hashes, and install with hash verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` - Review and update pinned versions through a controlled dependency-update process. - Install the package in a dedicated virtual environment rather than the global Python environment. - Prefer a trusted operating-system package or a verified standalone release when an appropriate integrity-validation mechanism is available. - Avoid running the installation or media-processing pipeline as root. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:37
Finding

Predictable Shared Temporary Files Permit File Clobbering and Cross-Run Interference

Content
View full analysis
/dev/null && \ curl -s https://api.groq.com/openai/v1/audio/transcriptions \ ``` ```bash yt-dlp --write-info-json --skip-download -o "/tmp/reel" "https://www.tiktok.com/@user/video/123" && \ AUDIO_URL=$(python3 -c "import json; [print(f['url']) for f in json.load(open('/tmp/reel.info.json')).get('formats',[]) if f.get('ext')=='m4a'][:1]") && \ curl -sL "$AUDIO_URL" -o /tmp/reel-audio.m4a && \ ffmpeg -y -i /tmp/reel-audio.m4a -acodec libmp3lame -q:a 4 /tmp/reel-audio.mp3 2>/dev/null && \ curl -s https://api.groq.com/openai/v1/audio/transcriptions \ ``` ### Technical Analysis The workflow stores metadata and media under globally predictable names in `/tmp`. On multi-user systems, another local process may predict these names and attempt to create ...[truncated 2421 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
- Export cookies with a browser extension like "Get cookies.txt LOCALLY"
- Groq Whisper is free (rate-limited) and returns results in ~1-2 seconds
- Max audio length: 25 minutes per request
- Clean up temp files after: `rm -f /tmp/reel.info.json /tmp/reel-audio.*`
- Also works with TikTok, YouTube Shorts, and other platforms supported by yt-dlp

## Examples

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends downloaded audio to Groq for transcription and stores reel metadata and media in /tmp, but the description does not clearly warn users that third-party transmission and local persistence occur. This can lead users to process sensitive or private content without informed consent, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This step uploads the generated MP3 to api.groq.com, which is an external third-party service. The transmission is intentional and core to the feature, but it is still a real data-exposure surface because reel audio may contain personal, copyrighted, or sensitive information.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

Step 3: Transcribe with Groq Whisper

bash
curl -s https://api.groq.com/openai/v1/audio/transcriptions \
  -H "Authorization: Bearer $GROQ_API_KEY" \
  -F "file=@/tmp/reel-audio.mp3" \
  -F "model=whisper-large-v3-turbo" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The example pipeline again transmits reel audio to Groq, creating the same external data-sharing risk in a copy-pasteable one-liner that users may run without noticing. Example commands can amplify risk because they normalize direct upload of potentially sensitive content.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
AUDIO_URL=$(python3 -c "import json; [print(f['url']) for f in json.load(open('/tmp/reel.info.json')).get('formats',[]) if f.get('ext')=='m4a'][:1]") && \
curl -sL "$AUDIO_URL" -o /tmp/reel-audio.m4a && \
ffmpeg -y -i /tmp/reel-audio.m4a -acodec libmp3lame -q:a 4 /tmp/reel-audio.mp3 2>/dev/null && \
curl -s https://api.groq.com/openai/v1/audio/transcriptions \
  -H "Authorization: Bearer $GROQ_API_KEY" \
  -F "file=@/tmp/reel-audio.mp3" \
  -F "model=whisper-large-v3-turbo" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This TikTok example extends the same external-upload behavior to another platform, increasing the range of content that may be sent to a third party. While not malicious, it broadens privacy and policy exposure without adding any additional warning or control.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
AUDIO_URL=$(python3 -c "import json; [print(f['url']) for f in json.load(open('/tmp/reel.info.json')).get('formats',[]) if f.get('ext')=='m4a'][:1]") && \
curl -sL "$AUDIO_URL" -o /tmp/reel-audio.m4a && \
ffmpeg -y -i /tmp/reel-audio.m4a -acodec libmp3lame -q:a 4 /tmp/reel-audio.mp3 2>/dev/null && \
curl -s https://api.groq.com/openai/v1/audio/transcriptions \
  -H "Authorization: Bearer $GROQ_API_KEY" \
  -F "file=@/tmp/reel-audio.mp3" \
  -F "model=whisper-large-v3-turbo" \

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description frames the skill specifically as an Instagram Reels tool, but the documentation explicitly states it also works with TikTok, YouTube Shorts, and other yt-dlp-supported platforms, and even provides a TikTok transcription example. That broadens the effective behavior beyond the manifest's stated scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.