ClawHub
Back to skill

Security audit

Arch Video Cut

Security checks for vulnerabilities and agentic risk

Overview

The skill is a local video-editing workflow, but it builds shell commands from editable saved preferences, creating a real command-execution risk.

Review or patch the subprocess command construction before installing, especially if you might import or share preference files. Use it only in a contained workspace with trusted media and trusted config/user_preferences.json, and expect it to save local editing preferences and overwrite its fixed output video files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/full_workflow.py:166
Finding

Arbitrary Shell Command Injection Through Unvalidated Preference Values

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:28
Finding

Unpinned and Unlocked Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (18)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

This is the core risky pattern: a generic command runner uses shell=True for all generated ffmpeg/ffprobe commands, magnifying the attack surface across the workflow. Several command components come from learned preferences and generated file lists, so hostile values can abuse shell parsing or break command boundaries.

Content

Scanner excerpt · scripts/full_workflow.py (reported line 43)May include surrounding context.

python
"""运行命令并打印进度"""
    if description:
        print(f"🎬 {description}...")
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"❌ 失败：{result.stderr}")
        return False

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The shell is unnecessarily invoked for a simple ffprobe call. In this workflow context the immediate risk is moderated by the hard-coded audio path, but the coding pattern remains unsafe and could become exploitable when adapted to external input.

Content

Scanner excerpt · scripts/full_workflow.py (reported line 84)May include surrounding context.

python
]
    
    # 获取音频时长
    result = subprocess.run(
        f'ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 "{AUDIO_FILE}"',
        shell=True, capture_output=True, text=True
    )

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

This shell-based ffprobe invocation repeats the same unsafe command-execution pattern for the output file. While less directly attacker-controlled in the current script, it reinforces an insecure habit and leaves room for exploitation if output paths become configurable or influenced by external state.

Content

Scanner excerpt · scripts/full_workflow.py (reported line 236)May include surrounding context.

python
# 显示文件信息
    if OUTPUT_FILE.exists():
        size = OUTPUT_FILE.stat().st_size / 1024 / 1024
        result = subprocess.run(
            f'ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 "{OUTPUT_FILE}"',
            shell=True, capture_output=True, text=True
        )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README content, headings, and usage guidance are written in Chinese and do not offer an alternative language or indicate that the skill is intentionally region- or audience-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file states that the script automatically remembers settings and retains the most recent 20 adjustment records, but it does not warn users that their preferences and usage history will be stored on disk. Because this behavior affects user data and privacy, the skill description should explicitly disclose the persistence and retention behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill does disclose its self-learning behavior in several sections, but the flagged area indicates the main description lacks a clear upfront warning that user preferences are automatically recorded and reused. That can mislead users about persistence and privacy expectations, especially because editing habits may reveal sensitive workflow patterns or file usage behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill's natural-language interface and descriptive text are entirely in Chinese, with no indication that the user can choose another language or locale. Under the stated policy, a fixed language without user opt-in is a language/locale policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script imports preference-learning functions and immediately loads stored user preferences at startup, while the module header also advertises that it 'automatically learns user preferences.' Although this is partially documented in comments/docstrings, there is no runtime disclosure near startup that preference data is being read from or persisted for future runs, which affects user data handling.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
96% confidence
Finding

The helper executes shell commands via subprocess.run(..., shell=True) using command strings assembled from paths and preference-derived values. If any interpolated value contains shell metacharacters or is attacker-controlled through files, preferences, or environment manipulation, this can lead to arbitrary command execution.

Content

Scanner excerpt · scripts/full_workflow.py (reported line 43)May include surrounding context.

python
"""运行命令并打印进度"""
    if description:
        print(f"🎬 {description}...")
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    if result.returncode != 0:
        print(f"❌ 失败：{result.stderr}")
        return False

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script creates and overwrites several files, including temporary lists, subtitle files, generated audio, and final video outputs. While progress messages appear after execution begins, there is no clear upfront warning that running the workflow will modify the filesystem and overwrite outputs via ffmpeg's '-y' option.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The function is named transcribe_audio, the workflow labels this step as 语音转录, and the module docstring advertises 语音转录字幕, implying subtitles are derived from the audio content. In reality, the code ignores the audio for transcription and writes a fixed list of subtitle strings, using the audio only to measure duration.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
88% confidence
Finding

This ffprobe invocation uses shell=True with a formatted command string containing a filesystem path. Although AUDIO_FILE is hard-coded here, using the shell for simple argument passing is unsafe by default and becomes exploitable if the path is ever made configurable or derived from untrusted input.

Content

Scanner excerpt · scripts/full_workflow.py (reported line 84)May include surrounding context.

python
]
    
    # 获取音频时长
    result = subprocess.run(
        f'ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 "{AUDIO_FILE}"',
        shell=True, capture_output=True, text=True
    )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
86% confidence
Finding

This ffprobe call again uses shell=True with a command string containing a path. The current output path is internally defined, but the pattern is dangerous because any future change that makes the path user-controlled could turn it into command injection.

Content

Scanner excerpt · scripts/full_workflow.py (reported line 236)May include surrounding context.

python
# 显示文件信息
    if OUTPUT_FILE.exists():
        size = OUTPUT_FILE.stat().st_size / 1024 / 1024
        result = subprocess.run(
            f'ffprobe -v error -show_entries format=duration -of default=noprint_wrappers=1:nokey=1 "{OUTPUT_FILE}"',
            shell=True, capture_output=True, text=True
        )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This Python file contains its top-level usage documentation entirely in Chinese, and the rest of the script continues that language choice in user-facing output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The interactive experience uses Chinese-only prompts and confirmations, which imposes a specific language on all users. The file does not present a language option or explain a region-specific requirement that would justify the restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code's user-facing description and CLI output are written exclusively in Chinese, and the file does not indicate that the skill is region-specific or that users can opt into another language. Under the language/locale policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This markdown file documents creation of output video files and a configuration reset command, but it does not warn users that running the workflow may overwrite existing outputs or that reset will modify stored preferences. For markdown files, SQP-2 applies when descriptions omit warnings about behaviors that could affect user data or system state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The guide instructs users to run python3 scripts/manage_preferences.py reset and says it restores all settings to defaults, but it does not explicitly warn that previously learned preferences will be lost. For a user-data-affecting operation, the markdown should include a clearer warning about this overwrite/reset effect.

Content

No source excerpt is available for this finding.