ClawHub
Back to skill

Security audit

Reel Digest

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for video analysis, but its scripts handle user-supplied URLs and output paths unsafely enough that crafted input could run commands on the user's machine.

Review carefully before installing. Only use this in a restricted environment, avoid untrusted video links, avoid attacker-controlled output directories, and prefer a fixed version that removes shell=True, validates URLs and paths, keeps TLS verification enabled, and uses private temporary directories.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/reel-digest.py:25
Finding

Shell Command Injection Through User-Controlled URL and Output Paths

Content
View full analysis
/dev/null') if os.path.exists(out_path): paths.append(out_path) return paths ``` ```python def extract_audio(video_path, output_path): run(f'ffmpeg -y -i "{video_path}" -vn -acodec pcm_s16le -ar 16000 -ac 1 "{output_path}" 2>/dev/null') return os.path.exists(output_path) ``` ### Technical Analysis The program constructs shell command strings using externally controlled values and invokes them with `shell=True`. Placing a value inside double quotes does no ...[truncated 2045 chars]
Remediation
View remediation
/dev/null`; use `stderr=subprocess.DEVNULL` instead. 4. Validate URLs before use: - Permit only required schemes such as `https`. - Reject control characters. - Consider restricting hosts where the use case permits it. 5. Validate and normalize output directories. Where user-selected paths are unnecessary, create a private temporary directory internally. 6. Add regression tests containing shell metacharacters, command substitutions, quotes, spaces, and newline characters to confirm that they are treated only as literal argument data. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/ig-reel-dl.sh:58
Finding

Python Code Injection Through the Bash Output Directory Argument

Content
View full analysis
/dev/null && echo "Transcription done" || echo "Transcription failed" fi ``` ### Technical Analysis `OUTDIR` is the script's second positional argument: ```bash OUTDIR="${2:-/tmp/reel-dl}" ``` It is expanded directly into source code passed to `python3 -c`. Although the generated Python path is surrounded by single quotes, the output-directory value is not escaped as a Python string literal. An output directory containing a single quote can terminate the intended Python string. The remainder of the directory name can then introduce arbitrary Python statements, while a comment character can suppress the trailing generated source. This is source-code injection rather than ordinary shell injection: Bash first substitutes the value into the Python program, and the Python interpreter then parses the attacker-controlled content as executable code. ### Attack Path 1. The attacker controls or influences the second positional argument passed to `ig-reel-dl.sh`. 2. The attacker supplies an output-directory string shaped like: ```text /tmp/x');__import__("os").system("id");# ``` 3. Bash creates and uses the quote-bearing directory because such characters are valid in Unix filenames. 4. If audio extraction succeeds and produces more than 1,000 bytes, the transcription block runs. ...[truncated 789 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/ig-reel-dl.sh:6
Finding

Predictable Shared Temporary Directory Allows Symlink Attacks and Artifact Disclosure

Content
View full analysis
/dev/null || true ``` ```bash ffmpeg -y -i "$OUTDIR/video.mp4" -vn -acodec pcm_s16le -ar 16000 -ac 1 "$OUTDIR/audio.wav" 2>/dev/null || true ``` ```python with open('${OUTDIR}/transcript.txt', 'w') as f: ``` The documented command recommends another fixed shared path: ```bash bash scripts/ig-reel-dl.sh "" /tmp/reel-digest ``` ### Technical Analysis Names such as `/tmp/reel-dl` and `/tmp/reel-digest` are predictable. The script neither creates the directory atomically nor confirms that it is newly created, privately owned, and free of symbolic links. A local attacker can create the directory before the victim runs the skill and populate it with malicious symlinks. The script then uses overwrite-capable operations including `curl -o`, `ffmpeg -y`, and Python write mode without checking whether destination entries are symlinks. The script also does not set a restrictive `umask`. Depending on the invoking environment's default permissions, downloaded videos, extracted audio, frames, and transcripts may be readable by other local users. ### Attack Path 1. A local attacker predicts that the victim will use `/tmp/reel-digest ...[truncated 1289 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/reel-digest.py:98
Finding

TLS Certificate Verification Disabled for yt-dlp Downloads

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill description says it is for broad video analysis and not for downloading videos to watch, but the documented behavior includes saving full videos locally and using Instagram-specific extraction steps. This mismatch can mislead users and operators about what the skill actually does, weakening consent, review, and policy enforcement around copyrighted or third-party media handling.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

This is the same underlying issue as AST4 at line 25: a generic shell execution helper creates a tool-parameter abuse pathway because downstream parameters can influence the shell command. In a skill that processes untrusted remote media and user-provided URLs, this context makes the flaw more dangerous because filenames and paths may be attacker-controlled or derived from attacker-controlled inputs.

Content

Scanner excerpt · scripts/reel-digest.py (reported line 25)May include surrounding context.

python
def run(cmd, timeout=60):
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    if result.returncode != 0:
        print(f"ERROR: {cmd}\n{result.stderr}", file=sys.stderr)
        sys.exit(1)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
100% confidence
Finding

The skill accepts arbitrary user-submitted video URLs, then inserts the URL directly into a shell command for yt-dlp. Because this is a tool boundary where untrusted input is passed into shell execution, it is a textbook tool-parameter abuse vulnerability that can result in arbitrary command execution on the agent host.

Content

Scanner excerpt · scripts/reel-digest.py (reported line 90)May include surrounding context.

python
# Try yt-dlp
    try:
        subprocess.run(
            f'yt-dlp "{url}" -o "{output_path}" --no-check-certificates --noprogress',
            shell=True, capture_output=True, text=True, timeout=30
        )

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Using --no-check-certificates disables TLS certificate validation for remote downloads. In a tool that fetches untrusted media from the network, this increases exposure to man-in-the-middle attacks, allowing an attacker on the network path to tamper with the downloaded content or redirect retrieval to malicious data.

Content

Scanner excerpt · scripts/reel-digest.py (reported line 91)May include surrounding context.

python
# Try yt-dlp
    try:
        subprocess.run(
            f'yt-dlp "{url}" -o "{output_path}" --no-check-certificates --noprogress',
            shell=True, capture_output=True, text=True, timeout=30
        )
        if os.path.exists(output_path) and os.path.getsize(output_path) > 1000:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs the agent to use shell, network access, and file writes but declares no explicit tool scope or permissions. That increases the risk of overbroad execution, unexpected side effects, and misuse of downloaded content because reviewers and runtime policy layers cannot easily constrain what the skill is allowed to do.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill omits a warning that it downloads third-party video content and may pass extracted frames or transcripts into analysis tools, which can expose copyrighted, private, or sensitive material. In this context, the omission is more dangerous because the workflow explicitly pulls remote media, writes it to disk, and prepares it for further processing across tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code performs remote HTTP requests and writes multiple output files, including overwriting files via ffmpeg -y, but provides no explicit warning or confirmation before doing so. Although the script's purpose implies downloading a reel, it does not disclose that it will also extract frames, audio, and possibly a transcript into the output directory.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
99% confidence
Finding

The helper run() executes arbitrary shell command strings with shell=True. In this script, that helper is later used with commands containing user-influenced paths and derived filenames, so shell metacharacters in those values can lead to command injection and arbitrary code execution on the host running the skill.

Content

Scanner excerpt · scripts/reel-digest.py (reported line 25)May include surrounding context.

python
def run(cmd, timeout=60):
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout)
    if result.returncode != 0:
        print(f"ERROR: {cmd}\n{result.stderr}", file=sys.stderr)
        sys.exit(1)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/reel-digest.py (reported line 68)May include surrounding context.

python
print(f"[reel-digest] Session download failed: {e}")
        # Fallback: try curl with the URL immediately
        try:
            subprocess.run(
                ["curl", "-sL", "-o", output_path, "-H", "User-Agent: Mozilla/5.0",
                 "-H", "Referer: https://www.instagram.com/", "--max-time", "60", video_url],
                timeout=65

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
99% confidence
Finding

The yt-dlp invocation is built with an f-string that directly embeds the user-supplied url into a shell command and runs it with shell=True. A crafted URL containing quotes or shell metacharacters can break out of the quoted context and execute arbitrary commands, making this a direct remote command injection vector.

Content

Scanner excerpt · scripts/reel-digest.py (reported line 90)May include surrounding context.

python
# Try yt-dlp
    try:
        subprocess.run(
            f'yt-dlp "{url}" -o "{output_path}" --no-check-certificates --noprogress',
            shell=True, capture_output=True, text=True, timeout=30
        )

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This code creates a temporary or user-specified output directory, saves video, audio, transcript, frames, and metadata files, and persists them to disk. While it prints progress messages, it does not include a clear warning in code comments, docstrings, or usage text that running the tool will store potentially sensitive media-derived artifacts locally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.