ClawHub
Back to skill

Security audit

Ecommerce Video Script Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed ecommerce storyboard generator whose local file output and downstream handoff fit its purpose, with prompt-injection hygiene worth improving before use in untrusted pipelines.

Install only if you are comfortable sending product metadata to the configured AI provider and writing storyboard files locally. Review any selling_points.json from upstream tools before use, especially usage_instructions, and inspect storyboard.md before approving the optional Skill3 video-generation step.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:315
Finding

Untrusted Upstream Instructions Are Treated as Authoritative Prompt Directives

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 315–318
Vulnerability Type: Indirect prompt injection through untrusted configuration fields
Risk Level: Medium

Relevant Skill Text (English translation):

markdown
> **Additional instruction fields (must be followed strictly):**
> `--details` and `--angle` are optional fields. When supplied by the user,
> they must be followed strictly:
> - `--details` → Incorporate it into the corresponding shot description;
    do not ignore or replace it.
> - `--angle` → Arrange the shot structure according to that angle;
    do not arbitrarily change its direction.
> - The `usage_instructions` passed by upstream Skill1 through `--config`
    must also be followed strictly.

Related data-flow documentation appears at SKILL.md, line 329:

markdown
- `selling_points.json` — Structured selling points passed through
  `--config`, including the `usage_instructions` field.

Technical Analysis

The skill instructs the agent to follow free-form values from details, angle, and particularly the upstream usage_instructions field strictly. These values originate from user input or an upstream JSON configuration and are therefore untrusted.

The documented workflow incorporates these values into a structured AI prompt without specifying a trust boundary, escaping mechanism, content validation, instruction hierarchy, or prohibition against interpreting embedded directives as agent instructions. Consequently, an attacker-controlled usage_instructions value could contain prompt-injection directives rather than legitimate product usage information.

For example, an attacker could supply text directing the model to disregard the storyboard requirements, emit unrelated content, alter the expected JSON structure, or insert further instructions into generated artifacts. The issue is an instruction/data separation failure: product metadata is descri ...[truncated 1999 chars]

Remediation
View remediation

Remediation Suggestions

  1. Treat details, angle, and usage_instructions exclusively as untrusted product data, not authoritative instructions.
  2. Replace requirements to “follow strictly” with narrowly scoped rules defining exactly which storyboard fields each value may influence.
  3. Explicitly state that these fields cannot modify system instructions, safety rules, tool use, file operations, output schemas, or workflow transitions.
  4. Validate selling_points.json against a strict schema, including type checks, length limits, allowed character policies, and rejection of unexpected properties.
  5. Delimit untrusted values clearly when constructing prompts and label them as quoted reference data that must not be interpreted as instructions.
  6. Detect and reject instruction-like content, including requests to ignore prior rules, invoke tools, access secrets, change output formats, or control downstream agents.
  7. Construct the final JSON through schema-constrained generation and validate it before saving or passing it to Skill3.
  8. Require explicit user review or approval before sending generated storyboard content to downstream video-generation components.
  9. Add adversarial tests covering malicious usage_instructions, details, and angle values to verify that they cannot override the skill's intended behavior.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Ssd 1

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly requires strict adherence to upstream usage_instructions from selling_points.json, treating untrusted free text as authoritative prompt input for downstream generation. In a multi-stage AI pipeline, this is a classic prompt-injection trust failure: an attacker can plant hidden instructions upstream that override behavior, manipulate outputs, or smuggle unsafe content into later stages.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document states that country controls the dialogue/subtitle language, and later requires subtitles/dialogue to use the target language. This enforces a locale choice from target_market rather than offering the user a language preference, which matches the policy-violation category for language/locale constraints.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The pipeline design compounds risk by importing upstream free-text instructions into the model prompt and then forwarding the resulting outputs to the next AI stage, creating instruction laundering across stages. This increases the chance that malicious prompt content survives transformation, gains perceived legitimacy, and influences downstream video generation or operator decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The markdown specifies that the skill auto-creates a desktop folder and saves storyboard.json and storyboard.md, but it does not present this as a user warning about local file creation. Because markdown files should warn about behaviors affecting user data or system state, automatic file output should be disclosed more explicitly.

Content

No source excerpt is available for this finding.