Video Dub Clawhub

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:29 AM UTC
• Version: 1.0.4

Overview

This is mostly a real video dubbing pipeline, but it can silently change the opening translated speech for a configured channel and has broad network behavior that should be reviewed before installation.

Review channel_rules.json before use and disable the intro override unless you explicitly want inserted narration. Install in an isolated environment, pin dependencies if possible, avoid using browser-cookie access unless necessary, and assume subtitle/TTS text may be sent to external translation or TTS providers.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: video_pipeline/scripts/enrich_subtitles.py:1377

Finding

Undisclosed Channel-Specific Replacement of Translated Speech

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: video_pipeline/scripts/download.py:274

Finding

Unvalidated Thumbnail URL Enables Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: video_pipeline/scripts/services/volcengine_tts_provider.py:167

Finding

Unvalidated VolcEngine Audio URL Enables Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: video_pipeline/requirements.txt:1

Finding

Unbounded Dependency Versions Create Supply-Chain and Build Reproducibility Risk

Content

View full analysis

=2025.1.26 openai-whisper>=20240930 torch>=2.2.0 openai>=1.30.0 requests>=2.31.0 ``` ### Technical Analysis Every dependency uses a lower-bound constraint without an upper bound or exact version. A future release therefore satisfies the dependency specification even if it has not been reviewed or tested with this project. Several dependencies are security-sensitive and have substantial execution capabilities. They perform network requests, parse complex media, load machine-learning components, or invoke package installation logic. If a future compatible release is compromised, malicious, or unexpectedly incompatible, installation or runtime execution can affect the Skill host. This finding does not demonstrate that any currently named package is malicious. It identifies the absence of reproducible dependency resolution and controls against future upstream changes. ### Attack Path 1. A future compromised, malicious, or vulnerable package release is published under one of the legitimate dependency names. 2. The release satisfies the project's `>=` constraint. 3. A user installs the Skill dependencies in a new or updated environment. 4. The package manager selects the unreviewed release. 5. Package installation or later import/runtime behavior executes with the privileges of the user running the installation or pipeline. ### Impact Assessment A compromised dependency can obtain all privileges available to the Python installation and pipeline process, including reading accessible files, accessing configured API credentials, making network connections, altering generated artifacts, and executing local commands. The exact impact depends on the account used for installation. No evidence shows that the project itself requests administrator privileges, so ...[truncated 82 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (78)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 83% confidence

Finding

The documented behavior and declared purpose do not fully align with the operational requirements described in the skill, especially the use of external translation services and unstated network-dependent processing. Misleading or incomplete capability disclosure is dangerous because reviewers and users may approve or invoke the skill without understanding what data leaves the system or what execution privileges are actually required.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

pip install -r video_pipeline/requirements.txt

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

pip install -r video_pipeline/requirements.txt

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Launching PowerShell with ExecutionPolicy Bypass weakens an important policy control and normalizes execution of generated scripts outside local policy restrictions. In this code the script is locally generated, so this is not by itself arbitrary code execution, but it does reduce defense-in-depth and increases the blast radius if an attacker can tamper with generated script files or influence the working environment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares no explicit tool scope or permissions even though the documentation clearly indicates it needs environment access, filesystem read/write, network access, and shell execution. In an agent ecosystem, this omission can cause the skill to run with broader-than-expected authority or without informed user consent, increasing the risk of misuse or unsafe execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description does not clearly warn that user-provided media or derived text may be transmitted to third-party services for translation and possibly TTS/download-related processing. This is a privacy and compliance risk because users may supply copyrighted, confidential, or sensitive audio/video content without understanding that it could be sent off-device to external providers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest advertises downloading, translating, dubbing, and retiming videos, but it does not warn users that the skill will access third-party services and alter media artifacts. Absent clear disclosure, users may unknowingly authorize network retrieval, processing of copyrighted or sensitive content, and generation of modified outputs they did not expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The default prompt is broad enough that many generic requests about videos, translation, subtitles, or dubbing could match it, making accidental or overbroad invocation more likely. In combination with a skill capable of downloading and modifying content from external platforms, vague trigger scope can cause the agent to select this tool when the user did not clearly intend those actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

allow_implicit_invocation: true permits the skill to be invoked without an explicit user request, increasing the chance the agent will trigger a workflow that downloads and transforms external media unexpectedly. Because this skill performs network access and content modification, implicit invocation raises the risk of surprise execution, unintended external requests, and user-consent bypass.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This JSON config sets the default voice_type to a Chinese-specific voice, and additional channel entries also hard-code Chinese voice variants. Because SQP-3 applies to all file types and covers language/locale policy violations, forcing a specific language/locale in configuration without any visible opt-in or justification is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The per-channel rule assigns a Chinese voice variant directly in configuration, and similar assignments recur in later entries. This indicates the skill behavior is pinned to a specific language/locale rather than offering a choice, which matches the SQP-3 policy example for locale constraints without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The default configuration sets voice_type to zh_male_m191_uranus_bigtts, which is a language/locale-specific choice embedded in code. The file does not present this as an explicit user option or document a justified region-specific constraint, so it constitutes a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code normalizes voice_type and falls back again to zh_male_m191_uranus_bigtts, reinforcing a forced language/locale default. Because no user choice or documented justification is present in this file, this appears to violate the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script writes updated subtitle metadata back to the input structured JSON via write_text, and this can modify user data in place as part of normal execution. Although there are informational prints for some later steps, there is no user-facing disclosure at the write site or argument parsing that the input file will be changed.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · video_pipeline/scripts/dub_video.py (reported line 237)May include surrounding context.

python

"1",
        "-",
    ]
    result = subprocess.run(command, capture_output=True)
    if result.returncode != 0:
        stderr = result.stderr.decode("utf-8", errors="ignore").strip()
        raise RuntimeError(stderr or f"ffmpeg failed to decode audio: {path}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · video_pipeline/scripts/retime_video.py (reported line 269)May include surrounding context.

python

"1",
        "-",
    ]
    result = subprocess.run(command, capture_output=True)
    if result.returncode != 0:
        stderr = result.stderr.decode("utf-8", errors="ignore").strip()
        raise RuntimeError(stderr or f"ffmpeg failed to decode audio: {path}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · video_pipeline/scripts/reverse_finish_bilibili.py (reported line 262)May include surrounding context.

python

"1",
        "-",
    ]
    result = subprocess.run(command, capture_output=True)
    if result.returncode != 0:
        stderr = result.stderr.decode("utf-8", errors="ignore").strip()
        raise RuntimeError(stderr or f"ffmpeg failed to decode audio: {path}")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The ffmpeg command includes -y, which forces overwrite of the destination file without prompting. In an automation pipeline this can silently replace prior outputs, and if an attacker can influence filenames or symlink targets in the output directory, it can contribute to destructive file clobbering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script sends subtitle text to an external translator service via translator.translate_sentences(...) without any disclosure or consent mechanism in this file. Because subtitle files may contain proprietary, sensitive, or personal content, silently forwarding them to a third-party service creates a real confidentiality and compliance risk, especially in a batch-processing localization pipeline where users may assume processing is local.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The argument parser description says the script will 'Translate English subtitles to Chinese and build sentence-level structured JSON,' which implies a straightforward translation pipeline. However, the code later calls apply_intro_override() to replace or merge the opening translation with a fixed Chinese intro containing the current production date (L1369-L1400), meaning output is not purely derived from the source subtitles.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The CLI description explicitly states the script will translate English subtitles to Chinese, and the implementation consistently emits Chinese text fields and Chinese intro text. This imposes a specific language/locale on users without offering a choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · video_pipeline/scripts/add_subtitles.py (reported line 111)May include surrounding context.

python

]

    print(f"[INFO] Extracting audio from: {video_path.relative_to(PROJECT_ROOT)}")
    result = subprocess.run(command, capture_output=True, text=True)
    if result.returncode != 0:
        raise RuntimeError(result.stderr.strip() or "ffmpeg failed without stderr output")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · video_pipeline/scripts/dub_video.py (reported line 283)May include surrounding context.

python

]

    print(f"[INFO] Extracting audio from: {video_path.relative_to(PROJECT_ROOT)}")
    result = subprocess.run(command, capture_output=True, text=True)
    if result.returncode != 0:
        raise RuntimeError(result.stderr.strip() or "ffmpeg failed without stderr output")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · video_pipeline/scripts/extract_audio.py (reported line 40)May include surrounding context.

python

]

    print(f"[INFO] Extracting audio from: {video_path.relative_to(PROJECT_ROOT)}")
    result = subprocess.run(command, capture_output=True, text=True)
    if result.returncode != 0:
        raise RuntimeError(result.stderr.strip() or "ffmpeg failed without stderr output")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · video_pipeline/scripts/prepare_video.py (reported line 86)May include surrounding context.

python

]

    print(f"[INFO] Extracting audio from: {video_path.relative_to(PROJECT_ROOT)}")
    result = subprocess.run(command, capture_output=True, text=True)
    if result.returncode != 0:
        raise RuntimeError(result.stderr.strip() or "ffmpeg failed without stderr output")