ClawHub
Back to skill

Security audit

mysteries-finalize

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed media-finalization workflow whose file changes and tool use fit its stated purpose.

Install this only for the intended Farsight media workflow. Before running it, confirm the correct project directory, expect generated transcripts and subtitles to be organized under Renders/Final, and consider whether subtitle content is acceptable to send through the translation provider used by deep-translator.

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger includes broad phrases like 'finalize a project' and 'prepare the final Farsight assets', which could match ordinary user requests and invoke a workflow that performs file processing and reorganization. In a skill that creates, renames, and moves files, unintended activation increases the chance of unauthorized or surprising modifications to project assets.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs creation of folders and renaming/moving of transcripts, subtitles, and thumbnails without requiring an explicit user warning or confirmation before modifying project files. This can cause accidental overwrites, broken downstream references, or unexpected changes in a production asset directory if the skill is triggered at the wrong time or on the wrong project.

Unbounded Output

Medium
Category
Output Handling
Content
- **Base HD:** 1920x1080, optimized to < 3MB.
   - **BIG:** 3840x2160, optimized to < 2MB.
   - **social_media:** 1200x630, optimized to 200KB - 300KB.
   - **Featured:** 3840x1440, no size limit, high quality. (Use Special Crop Rule)
   - **email:** 650x366, optimized to < 100KB.

## Phase 5: Organization & Cleanup
Confidence
72% confidence
Finding
Specifying 'no size limit' for the Featured thumbnail removes an important output constraint and can lead to unexpectedly large files, excessive disk use, or inefficient downstream handling. In a media pipeline skill that automatically generates assets, unbounded output is risky because it can degrade performance or disrupt storage and transfer expectations.

Static analysis

No suspicious patterns detected.