ClawHub
Back to skill

Security audit

infinimo-ai-design-video-create

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Infinimo video-generation helper that sends user-provided prompts, files, and an API token to the disclosed Clawec/Infinimo API.

Install only if you intend to use Infinimo/Clawec's cloud API. Do not upload confidential, regulated, or proprietary media or prompts unless that is approved for this service, and verify any log deletion action before using the documented delete endpoint.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose centers on creating AI videos and supporting generation workflows. The actual code only calls /video/create/logs with pagination parameters to fetch existing video creation logs. While result polling/history could be loosely adjacent to the broader domain, this specific chunk does not implement video generation or the described input modes. Its primary behavior is log retrieval, which is materially different from the declared generation-focused purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documents shell script execution (bash scripts/...) but does not declare any tool scope such as allowed-tools or permissions. In an agent environment, that mismatch can enable unintended shell access or make reviewers and policy layers misunderstand what the skill is capable of doing, increasing the chance of unsafe execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation specifies language=en as a common parameter, which imposes a specific language setting. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs users to upload images, video, audio, and prompts to a third-party API without a clear warning that this content leaves the local environment and is processed externally. That can cause unintentional disclosure of sensitive media, proprietary creative assets, or confidential prompt content, especially in enterprise contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script reads credentials from INFINIMO_TOKEN or INFINIMO_API_KEY and then sends a POST request to an external API using that token. There is no confirmation prompt, user-facing log, or explanatory comment/docstring warning that credentials and request data will be transmitted off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script builds a JSON payload containing the user-supplied prompt and optional attachments, then sends it via curl to a remote endpoint. No print/log statement, prompt, or inline documentation informs the user that their content is being sent over the network.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/create.sh (reported line 27)May include surrounding context.

sh
att=json.loads(attaches_raw)
if att: b["attaches"]=att
print(json.dumps(b,ensure_ascii=False))' "$MODE" "$PROMPT" "$MODEL" "$RATIO" "$SIZE" "$LENGTH" "$ATTACHES")
curl -s -X POST "https://www.clawec.com/api/aigc/ec_media/video/create" \
  -H "Token: $TOKEN" -H "Content-Type: application/json" -d "$PAYLOAD"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script reads authentication material from INFINIMO_TOKEN or INFINIMO_API_KEY, which are sensitive environment variables. The file contains no user-facing notice, comment, or other disclosure that credentials will be consumed for an external API call.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script performs an outbound HTTP request to an external API and transmits an authentication token in the request header. There is no confirmation prompt, logging, print statement, or explanatory comment/docstring in this file to disclose that network transmission to the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This shell script reads an API credential from environment variables and immediately sends an authenticated HTTP request, but provides no confirmation prompt, visible logging, or explanatory comment about the network transmission. For a code file, that combination matches the missing user warning criterion for network calls and credential use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The JSON payload includes "language":"en", which forces English behavior regardless of user preference. There is no opt-in, configurability, or explanation that this script is intentionally limited to English for a specific regional or compliance reason.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/point_calculate.sh (reported line 21)May include surrounding context.

sh
PAYLOAD=$(python3 -c 'import json,sys; m,md,r,s,l,p=sys.argv[1:8]; b={"create_mode":int(m),"model":md,"ratio":r,"size":s,"prompt":p,"platform":1,"terminal":4,"language":"en"};
ln=l.strip();
if ln: b["length"]=int(ln); print(json.dumps(b))' "$MODE" "$MODEL" "$RATIO" "$SIZE" "$LENGTH" "$PROMPT")
curl -s -X POST "https://www.clawec.com/api/aigc/ec_media/video/point_calculate" \
  -H "Token: $TOKEN" -H "Content-Type: application/json" -d "$PAYLOAD"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The curl request posts the generated JSON payload to an external HTTPS endpoint, and that payload includes user-supplied prompt data and other parameters. This file contains no confirmation prompt, no user-visible notice, and no inline comment/docstring disclosing that data will be transmitted off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code performs a network upload of user-specified file contents and includes an authentication token in the request headers. The script contains no confirmation prompt, comment, echo/log message, or other disclosure warninging the user that local file data and credentials are being transmitted to a remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This shell script performs a network upload of a local file to an external API and includes an authentication token in the request headers, but the file contains no confirmation prompt, warning message, or explanatory comments disclosing that behavior. Because transmitting local file contents and credentials is safety-relevant, the lack of any user-facing disclosure meets the missing-warning criteria for code files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The markdown exposes a deletion endpoint for video logs without warning that the action is destructive. A user or agent could remove job history or result references unintentionally, causing loss of auditability or difficulty recovering generated output metadata.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script hard-codes "language":"en" in the request payload, which imposes a specific language setting regardless of user preference. This is a natural-language policy concern because there is no opt-in, configuration flag, or documented rationale for restricting output to English.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The request hard-codes language=en, which imposes a specific language setting with no user opt-in or explanation. This is a natural-language policy concern because the skill fixes locale behavior rather than offering a choice or documenting why English is required.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script reads INFINIMO_TOKEN or INFINIMO_API_KEY from the environment to authenticate the outbound request. Although credential use is functional here, the file provides no comment, log message, or other disclosure that sensitive environment variables are consumed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The multipart form data includes language=en, which forces a specific language/locale in all invocations. There is no visible opt-in, configurability, or documented justification that would make the locale restriction acceptable under the policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The request payload includes a fixed natural-language setting of "language=en", which forces a specific language/locale choice. There is no indication in the file that this is user-configurable, optional, or justified by a region-specific purpose, so it fits the language/locale policy-violation category.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.