ClawHub
Back to skill

Security audit

Podcastifier

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it overstates its podcast/TTS behavior and ships unsafe temporary-file handling around ffmpeg.

Install only if you are comfortable treating this as unfinished sample code. Run it in a limited workspace, avoid privileged accounts, and review or fix the temporary-file handling before processing valuable files.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
podcastify.py:29
Finding

Insecure Temporary-File Creation Enables Local File Overwrite

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill description promises trusted media-processing behavior, but the implementation behavior reportedly does not actually perform TTS and instead generates silent placeholder audio while only handling local file/stdin input. This mismatch can mislead users and reviewers about what the skill really does, making it easier to hide unsafe behavior or cause operators to grant permissions based on false expectations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares executable capabilities that imply file read, file write, and shell access, but does not declare any explicit tool scope or permission boundaries. This creates unnecessary ambiguity about what the skill may access or execute at runtime, increasing the risk of overbroad filesystem or command execution if the skill is installed in a permissive environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The inline documentation says this function should be wired to a TTS provider and refers to a placeholder using a system 'say' command, implying speech generation from the provided text. In reality, the code ignores the text argument and invokes ffmpeg to create a 1-second silent WAV file, which contradicts the stated behavior of synthesizing podcast audio from text.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · podcastify.py (reported line 33)May include surrounding context.

python
# Placeholder: write to a dummy wav using say command (mac) or skip
    path = tempfile.mktemp(suffix=f"_{idx}.wav")
    # Replace this with real TTS call; here we just make a silent file
    subprocess.run(["ffmpeg", "-f", "lavfi", "-i", "anullsrc=r=44100:cl=mono", "-t", "1", "-q:a", "9", "-acodec", "pcm_s16le", path], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    return path

def main():

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
83% confidence
Finding

The ffmpeg concat invocation is fed by a list file built from temporary paths and uses '-safe 0', which disables ffmpeg's path-safety checks. Because the code also creates filenames with tempfile.mktemp, an attacker on the same system could exploit the race window or path manipulation to influence what files ffmpeg reads during concatenation, making this more dangerous in multi-user or shared execution environments.

Content

Scanner excerpt · podcastify.py (reported line 48)May include surrounding context.

python
with open(concat_list, 'w') as f:
            for w in wavs:
                f.write(f"file '{w}'\n")
        subprocess.run(["ffmpeg", "-f", "concat", "-safe", "0", "-i", concat_list, "-c", "copy", args.out], check=True)
        print(f"Output: {args.out}")
    finally:
        for w in wavs:

Static analysis

No suspicious patterns detected.