ClawHub
Back to skill

Security audit

llm-video-generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent ZhipuAI video-generation helper, with ordinary media-processing and API-use risks users should understand before installing.

Install only if you are comfortable sending video prompts and any provided images to ZhipuAI and storing task metadata locally. Use a virtual environment, pin/review `zai-sdk`, avoid sensitive images or prompts, and do not concatenate media files with untrusted or unusual filenames until the concat escaping issue is fixed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:204
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation
``` 2. Maintain dependencies in a locked requirements file that includes cryptographic hashes: ```text zai-sdk== --hash=sha256: ``` Install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Pin and review all transitive dependencies, preferably through a reproducible lockfile. 4. Explicitly configure an approved HTTPS package index rather than relying on arbitrary user-level pip configuration. 5. Perform installation in an isolated virtual environment with minimal permissions. 6. Add an update process that reviews new versions before changing the lockfile or hashes. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/concat_videos.py:25
Finding

FFmpeg Concat Manifest Injection Through Unescaped Filenames

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The description claims an AI-powered video generation skill with multiple input modalities and model-based continuation logic. The actual code only validates input file paths, writes an ffmpeg concat list, and invokes ffmpeg to merge existing video files. This is a materially different primary purpose: post-processing/combining videos rather than generating them. No AI generation, no ZhipuAI integration, and none of the declared creation capabilities are present.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This is a clear description-behavior mismatch. The declared purpose centers on generating videos via the ZhipuAI CogVideoX-3 model from prompts or images, with advanced generation features. The actual code does none of that: it accepts a path to an already-existing video file, invokes ffmpeg/ffprobe, and extracts the last frame to a PNG. While last-frame extraction could be a supporting helper inside a larger video-generation pipeline, the supplied code chunk by itself only implements frame extraction and not the declared primary functionality. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code substantially matches the core declared purpose of generating videos via ZhipuAI CogVideoX-3 in text-to-video, image-to-video, and first/last-frame modes. However, the description overstates important capabilities that are not present in the implementation. Most notably, the code generates only a single task per invocation and even documents that each generation produces about 5 seconds of video; there is no logic to split longer requests, use last-frame continuation, or chain multiple calls. It also does not expose a duration argument. The rest of the behavior—polling, saving JSON metadata, converting local image files, and downloading the output video—is consistent supporting functionality rather than a mismatch. Because the missing long-video chaining is a material claimed feature, this should be flagged as a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill directs the agent to use shell commands, networked API calls, environment variables, and file creation/compression, but it declares no tool scope restrictions. In an agent environment, missing explicit permissions increases the chance of unintended command execution, file writes, or outbound requests if the skill is invoked inappropriately or manipulated through user-controlled inputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text is broad enough to match many generic requests involving video creation or conversion, increasing the chance the skill is auto-invoked outside the user's intended context. Because the skill then instructs the agent to perform network calls, shell execution, and file handling, accidental invocation expands the attack surface and could lead to unnecessary external requests or file operations.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/concat_videos.py (reported line 55)May include surrounding context.

python
"-movflags", "+faststart",
                output_path
            ]
            result2 = subprocess.run(cmd_reencode, capture_output=True, text=True)
            if result2.returncode != 0:
                print(f"ERROR: ffmpeg concat failed:\n{result2.stderr}", file=sys.stderr)
                sys.exit(1)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/concat_videos.py (reported line 40)May include surrounding context.

python
output_path
    ]
    print(f"Extracting last frame from {video_path}...")
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        # Fallback: try without sseof (some videos are very short)
        cmd2 = [

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract_last_frame.py (reported line 36)May include surrounding context.

python
output_path
    ]
    print(f"Extracting last frame from {video_path}...")
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        # Fallback: try without sseof (some videos are very short)
        cmd2 = [

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract_last_frame.py (reported line 48)May include surrounding context.

python
output_path
        ]
        # Get frame count first
        probe = subprocess.run(
            ["ffprobe", "-v", "error", "-count_frames", "-select_streams", "v:0",
             "-show_entries", "stream=nb_read_frames", "-of", "csv=p=0", video_path],
            capture_output=True, text=True

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract_last_frame.py (reported line 68)May include surrounding context.

python
"-q:v", "2",
            output_path
        ]
        result2 = subprocess.run(cmd_fallback, capture_output=True, text=True)
        if result2.returncode != 0:
            print(f"ERROR: ffmpeg failed:\n{result2.stderr}", file=sys.stderr)
            sys.exit(1)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest explicitly advertises support for videos longer than 5 seconds via chained calls with last-frame continuation. In this file, each mode submits exactly one client.videos.generations(...) request, and there is no logic to segment duration, extract a last frame, or invoke follow-up generations to extend the video.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest says the skill supports configuring duration, but the CLI accepts prompt, quality, audio, size, fps, output directory, and polling controls only. No argument or API field is provided for duration, so users cannot actually control this capability as described.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends user prompts and optionally local image content to a third-party video-generation API, but the code provides no explicit disclosure or consent mechanism at the point of use. In an agent context, users may reasonably assume local files stay local, so silent transfer of potentially sensitive images or text to an external service creates a real privacy and data-governance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The guidance says to use English prompts for best quality, which directs operation toward a specific language without offering user choice or opt-in. This can conflict with language/locale policy expectations when the user has provided input in another language.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script persists task metadata and result JSON files containing the user's prompt and task identifiers to disk without warning or minimization. In shared environments, multi-user systems, or retained workspaces, these files can expose sensitive creative content or private prompts beyond the user's expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.