ClawHub
Back to skill

Security audit

Reel Digest

Security checks for vulnerabilities and agentic risk

Overview

The skill does the stated video-analysis work, but its Python helper can run unintended shell commands from a crafted URL or output path.

Review or patch this skill before installing. At minimum, replace shell=True command strings with argument lists, validate URL schemes and domains, avoid disabling certificate checks, and keep outputs in a dedicated temporary directory. Use it only with URLs you trust, and delete generated video, audio, frame, transcript, and metadata files after analysis.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def run(cmd, timeout=60):
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    if result.returncode != 0:
        print(f"ERROR: {cmd}\n{result.stderr}", file=sys.stderr)
        sys.exit(1)
Confidence
98% confidence
Finding
The helper `run()` executes arbitrary shell strings with `shell=True`, and it is later fed commands containing file paths and derived values. This creates command-injection risk if any interpolated value contains shell metacharacters, and it broadens the attack surface beyond the skill's stated video-processing purpose.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# Try yt-dlp
    try:
        subprocess.run(
            f'yt-dlp "{url}" -o "{output_path}" --no-check-certificates --noprogress',
            shell=True, capture_output=True, text=True, timeout=30
        )
Confidence
99% confidence
Finding
The `yt-dlp` invocation builds a shell command by directly interpolating the user-supplied URL and output path into a string executed with `shell=True`. An attacker can supply crafted input containing quotes or shell metacharacters to execute arbitrary commands on the host.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs the agent to use shell commands, make network requests, and write files, but it does not declare permissions or clearly scope those capabilities. This creates an authorization and transparency gap: users and the platform may not realize the skill can fetch remote content and persist artifacts locally, increasing the risk of unintended data exposure or misuse.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill says it will download, extract, and transcribe media, but it does not clearly warn users that video, audio, transcripts, and frames are stored locally in /tmp or copied into the workspace. This is dangerous because analyzed content may include sensitive or copyrighted material, and local persistence creates residual data that could be accessed later by other processes, users, or subsequent tasks.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill accepts arbitrary user-provided URLs and performs third-party network requests to platforms like Instagram, YouTube, TikTok, X, or direct MP4 hosts without a clear privacy warning. This can leak user intent and access metadata to external services, and if unrestricted it may also enable requests to untrusted hosts or internal resources through crafted URLs.

Static analysis

No suspicious patterns detected.