ClawHub
Back to skill

Security audit

Bilingual Digital Human Spokesperson

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent bilingual video-production workflow, but it handles face images, voice/audio, and user scripts through external services without enough explicit consent and scoping.

Review before installing if your scripts, presenter images, or voice/audio are sensitive. Use the local SadTalker or ffmpeg fallback when privacy matters, confirm before using edge-tts, D-ID, or HeyGen, avoid public unauthenticated media URLs, and review any pip/GitHub dependencies before setup.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The declared description promises an automated end-to-end bilingual video generation workflow from text, including avatar generation, bilingual speech generation, optional translation, subtitle generation, and final synthesis. The supplied code does only the final assembly/compositing stage: it probes durations, builds SRT files from provided transcripts, burns subtitles into existing videos, creates labeled title cards, scales clips, and concatenates them. While this partially aligns with the final 'compose one video' outcome, the primary promised capabilities—digital human creation, TTS/voice generation, and translation from a single input script—are absent. There are no suspicious undeclared resource accesses beyond local files and ffmpeg subprocesses; the mismatch is mainly that the implementation is a narrower media-composition utility than the declared full-generation skill.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description promises an end-to-end bilingual video generator: accept English copy, optionally translate to Arabic, generate a digital human, produce English and Arabic voiceover plus subtitles, and synthesize one final video containing both language segments. The supplied code does something much narrower: it renders a talking-head video from a provided image and a provided audio file. Its engines are lip-sync backends (SadTalker, D-ID, HeyGen) or a still-image ffmpeg fallback. There is no logic for text ingestion, machine translation, TTS, subtitle creation, avatar creation, or stitching two language segments into one final bilingual asset. This is a material purpose mismatch, not just an implementation detail difference.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The description claims a full bilingual talking-video pipeline. The actual code shown is a limited support component for speech synthesis using edge-tts. It accepts text, language/voice options, outputs an MP3, and emits metadata JSON including duration. Those behaviors are consistent with part of a larger bilingual video system, but by itself the chunk does not perform the core declared functions of avatar creation, translation, subtitle creation, or final video assembly. Therefore the code chunk does not accurately represent the declared skill purpose and should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill instructs use of shell commands, package installation, environment variables, file reads/writes, and network-dependent services, but it does not declare any explicit tool scope or permissions. This creates a governance and containment gap: an agent may invoke more capability than a reviewer or runtime policy expects, increasing the chance of unintended command execution, dependency installation, or external data exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Defaulting to automatic English-to-Arabic translation and mandating Arabic output without clear opt-in can cause unintended disclosure or transformation of user-provided text to external or network-backed components. In this skill context, translation materially changes user content handling and could send sensitive copy through additional processing steps the user did not explicitly request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Overly broad trigger phrases can cause the skill to activate for generic spokesperson or talking-head requests that do not require its full shell/network/file workflow. In an agent environment, that expands the attack surface by increasing accidental invocation of a high-capability skill, potentially leading to unnecessary external calls, package installs, or processing of user content in ways the user did not intend.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document instructs that when only English is supplied, the content should be translated to Modern Standard Arabic automatically. This imposes a specific language/locale behavior without user opt-in, and the file does not state that the skill is region-specific or otherwise justified as Arabic-only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The cloud lip-sync sections for D-ID and HeyGen instruct the operator to send image and audio to third-party services, but do not clearly warn that user-provided media leaves the local environment and is processed by external vendors. This creates a real privacy and consent risk, especially because voice and face data are biometric-adjacent and may be sensitive in many contexts.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compose_bilingual.py (reported line 45)May include surrounding context.

python
ffprobe = shutil.which("ffprobe") or os.path.join(
        os.path.dirname(ffmpeg), "ffprobe"
    )
    out = subprocess.check_output(
        [
            ffprobe,
            "-v",

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compose_bilingual.py (reported line 93)May include surrounding context.

python
def run(cmd):
    print("[cmd]", " ".join(cmd))
    subprocess.run(cmd, check=True)


def main():

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This code sends the user's avatar image and driving audio to D-ID as base64-embedded payloads, which is a real external data transmission to a third-party cloud service. In this skill's context, the transmitted media may contain sensitive biometric and voice data, so the risk is elevated unless users are clearly informed and consent to cloud processing.

Content

Scanner excerpt · scripts/talking_head.py (reported line 147)May include surrounding context.

python
"config": {"fluent": True, "result_format": "mp4"},
    }
    req = urllib.request.Request(
        "https://api.d-id.com/talks",
        data=json.dumps(payload).encode(),
        headers=headers,
        method="POST",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/talking_head.py (reported line 158)May include surrounding context.

python
print(f"[talking_head] D-ID talk {talk_id} created, waiting...")
    while True:
        req2 = urllib.request.Request(
            f"https://api.d-id.com/talks/{talk_id}", headers=headers
        )
        with urllib.request.urlopen(req2, timeout=60) as resp:
            st = json.load(resp)

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This code submits a talking-photo generation request to HeyGen, causing user-provided media referenced by public URLs to be processed by an external service. In this skill, that is security-relevant because face images and voice/audio are privacy-sensitive, and the requirement for public URLs can further expand exposure if those assets are hosted insecurely or broadly accessible.

Content

Scanner excerpt · scripts/talking_head.py (reported line 193)May include surrounding context.

python
"dimension": {"width": 1280, "height": 720},
    }
    req = urllib.request.Request(
        "https://api.heygen.com/v2/video/talking_photo",
        data=json.dumps(payload).encode(),
        headers=headers,
        method="POST",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/talking_head.py (reported line 204)May include surrounding context.

python
print(f"[talking_head] HeyGen video {video_id} created, waiting...")
    while True:
        req2 = urllib.request.Request(
            f"https://api.heygen.com/v1/video_status.get?video_id={video_id}",
            headers=headers,
        )
        with urllib.request.urlopen(req2, timeout=60) as resp:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tts_edge.py (reported line 41)May include surrounding context.

python
if not ffprobe:
        return None
    try:
        out = subprocess.check_output(
            [
                ffprobe,
                "-v",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends user-provided text to edge-tts, which relies on an external network service, but the script provides no explicit notice, consent gate, or data-sensitivity warning before transmission. If users submit confidential scripts, names, internal messaging, or regulated content, that text may leave the local environment unexpectedly, creating privacy and compliance exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.