ClawHub
Back to skill

Security audit

CinePrompt

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its CinePrompt purpose, but it needs review because it combines an unpinned global CLI install with under-scoped external data sharing and an internal privileged database path.

Review this skill before installing. Prefer a pinned, local CLI install if available, do not run the npm install with elevated privileges, and avoid placing `CINEPROMPT_SERVICE_KEY` in general agent environments. Treat prompt text, state JSON, reference images, saved subjects, and BYOK provider keys as data that may be sent to CinePrompt/Supabase or listed generation providers, and use only credentials and content you are comfortable sending to those services.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Global Installation of an Externally Hosted CLI Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:14-18
Vulnerability Type: Uncontrolled third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash
# Install
npm install -g cineprompt

# Auth (Pro subscription required for API)
cineprompt auth cp_your_key_here

Technical Analysis

The installation instructions retrieve the current cineprompt package from the npm registry and install it globally without specifying an exact version or integrity hash. The source code for that installed package is not included in the audited project, so its effective behavior cannot be verified from this repository.

A global npm installation may execute package lifecycle scripts during installation and makes the resulting executable available across the user's environment. Because the dependency is not pinned, a future package release, compromised maintainer account, or registry compromise could cause users to execute code materially different from the code that was originally reviewed.

This finding does not establish that the current npm package is malicious. The risk arises from trusting mutable, unaudited third-party content and installing it globally.

Attack Path

  1. An attacker compromises the npm package, its publisher account, or a future release process.
  2. The attacker publishes a modified release under the expected package name.
  3. A user follows the Skill instructions and runs npm install -g cineprompt.
  4. npm downloads the latest release rather than a reviewed and pinned version.
  5. Malicious lifecycle or CLI code executes with the permissions of the user running npm.
  6. The globally installed command remains available for subsequent invocations.

Impact Assessment

Successful exploitation could provide code execution under the installing user's account. Potentially affected resources include files accessible to that account, environment variables, applicat ...[truncated 356 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to an exact reviewed version, for example:
    bash
    npm install --global cineprompt@X.Y.Z
  2. Publish and verify the package integrity hash and provenance for the recommended release.
  3. Provide a link to the source revision corresponding exactly to the published npm artifact.
  4. Prefer a project-local installation over a global installation:
    bash
    npm install --save-exact cineprompt@X.Y.Z
  5. Commit a lockfile where applicable and use npm ci in automated environments.
  6. Disable lifecycle scripts where they are unnecessary and operationally compatible:
    bash
    npm install --ignore-scripts --save-exact cineprompt@X.Y.Z
  7. Document that users should not run the installation with elevated privileges.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/create-share-link.js:38
Finding

Internal Supabase Service Credential Enables Direct Database Insertion

Content
View full analysis

Vulnerability Details

File Location: scripts/create-share-link.js:38-39, 71-77, 115-130
Vulnerability Type: Privileged credential fallback and access-control bypass
Risk Level: Medium

Vulnerable Code Snippet:

js
// Resolve auth
apiKey = apiKey || process.env.CINEPROMPT_API_KEY;
const serviceKey = process.env.CINEPROMPT_SERVICE_KEY;

if (!apiKey && !serviceKey) {
  console.error('Error: No auth. Set --api-key, CINEPROMPT_API_KEY, or CINEPROMPT_SERVICE_KEY.');
  process.exit(1);
}
js
let result;
if (apiKey) {
  // Authenticated RPC path (public skill)
  result = await createViaRPC(apiKey, promptText, stateJson, mode);
} else {
  // Direct insert path (internal/owner use)
  result = await createDirect(serviceKey, promptText, stateJson, mode);
}
js
async function createDirect(serviceKey, promptText, stateJson, mode) {
  const shortCode = generateShortCode();
  const res = await fetch(`${SUPABASE_URL}/rest/v1/shared_prompts`, {
    method: 'POST',
    headers: {
      'apikey': serviceKey,
      'Authorization': `Bearer ${serviceKey}`,
      'Content-Type': 'application/json',
      'Prefer': 'return=representation'
    },
    body: JSON.stringify({
      short_code: shortCode,
      prompt_text: promptText,
      state_json: stateJson,
      mode: mode
    })
  });

Technical Analysis

The public share-link utility supports two authentication paths. The expected public path calls the create_share_link RPC using a CinePrompt API key. The fallback path automatically reads CINEPROMPT_SERVICE_KEY and uses it as both the Supabase API key and bearer token to insert attacker-controlled data directly into the shared_prompts table.

Direct table insertion with an internal service credential is not required for the declared public share-link workflow. It bypasses the normal RPC entry point and any subscription checks, validation, rat ...[truncated 1862 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove CINEPROMPT_SERVICE_KEY support from the publicly distributed Skill and share-link utility.
  2. Move internal database insertion into a separate, access-controlled administrative tool that is not shipped to public users.
  3. Require all public requests to pass through the authenticated RPC or a dedicated backend API with authorization, schema validation, rate limiting, and audit logging.
  4. If an internal fallback is operationally unavoidable, require an explicit internal-only command-line flag rather than selecting it automatically when the public API key is absent.
  5. Use a narrowly scoped credential that can only perform the required insertion instead of a general Supabase service credential.
  6. Validate and constrain state_json, prompt_text, and mode before transmission, including maximum sizes and an allowlist of supported fields.
  7. Keep service credentials out of general agent environments and expose them only to the isolated administrative process that requires them.
  8. Rotate the credential if it has previously been exposed to shared or insufficiently isolated execution environments.
  9. Add monitoring and rate limits for direct record creation, and alert on unusual insertion volume or malformed state objects.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The CLI instructions explicitly ask the user to enter an API key and use networked operations, but provide no warning about secret handling, storage, shell history exposure, or transmission to external services. In an agent setting, this can lead to credential leakage, accidental logging, or users providing secrets without understanding where they will be sent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The Scene-to-Prompt, built-in generation, and BYOK features imply that user prompts, media, and third-party API keys may be sent to external services, yet the skill gives no privacy, retention, or third-party handling disclosure. This is risky because users may submit sensitive creative material, reference images, or provider credentials without informed consent about downstream processing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises an internal script that performs X trend scraping and generates Discord-ready content, which is unrelated to the stated cinematography prompt-building purpose. This creates hidden or adjacent functionality that could broaden data access and outbound communications, increasing the attack surface and making it easier for an agent or operator to invoke actions the user did not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends prompt_text and state_json to a remote Supabase endpoint, which may contain sensitive user content, but it does so without an explicit runtime warning, confirmation, or data-classification notice. In a CLI skill context, users may pipe local files or generated state into stdin and unintentionally exfiltrate private data to a third-party service.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This JSON manifest-like file includes the literal value "TikTok Reels short-form vertical video," which prescribes a specific platform format rather than offering a neutral or user-selected option. Under the language/locale policy category, forced platform- or locale-specific phrasing without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The duplicated value "TikTok Reels short-form vertical video" appears again in another field group, reinforcing a specific platform-oriented output style with no visible opt-in mechanism. Because this file is all natural-language field values, the issue is policy-related rather than code-related.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The code reads CINEPROMPT_API_KEY and CINEPROMPT_SERVICE_KEY from the environment, including a service key intended for internal or owner use only. While comments describe auth modes, there is no explicit warning to users that sensitive credentials may be consumed from environment variables or that the service key grants elevated access.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/create-share-link.js:38