ClawHub
Back to skill

Security audit

Book Video Generator En

Security checks across malware telemetry and agentic risk

Overview

This skill is a legitimate book-video generator, but users should understand that it uses external AI/TTS services, local ffmpeg processing, and runtime dependency installation.

Install only if you are comfortable sending book titles, prompts, captions, and generated media to the selected search, LLM, image, and TTS providers. Pre-install reviewed dependencies where possible, avoid running the scripts on sensitive text, and use sandbox-bypass troubleshooting only in a trusted local directory.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (20)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
f.write(f"file '{cf}'\n")

    no_subs = os.path.join(tmpdir, "no_subs.mp4")
    subprocess.run(
        [FFMPEG, "-y", "-f", "concat", "-safe", "0", "-i", concat_list,
         "-c", "copy", no_subs],
        capture_output=True, check=True,
Confidence
93% confidence
Finding
subprocess.run( [FFMPEG, "-y", "-f", "concat", "-safe", "0", "-i", concat_list, "-c", "copy", no_subs], capture_output=True, check=True, )

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if need_mix:
        # 先烧录字幕到临时文件，再混音
        subs_output = os.path.join(tmpdir, "with_subs.mp4")
        subprocess.run(
            [FFMPEG, "-y", "-i", no_subs, "-vf",
             f"subtitles='{ass_escaped}':force_style='{style}'",
             "-c:a", "copy", subs_output],
Confidence
96% confidence
Finding
subprocess.run( [FFMPEG, "-y", "-i", no_subs, "-vf", f"subtitles='{ass_escaped}':force_style='{style}'", "-c:a", "copy", subs_output], capture

subprocess module call

Medium
Category
Dangerous Code Execution
Content
)
    else:
        # 无混音，直接烧录字幕到最终输出
        subprocess.run(
            [FFMPEG, "-y", "-i", no_subs, "-vf",
             f"subtitles='{ass_escaped}':force_style='{style}'",
             "-c:a", "copy", output_path],
Confidence
96% confidence
Finding
subprocess.run( [FFMPEG, "-y", "-i", no_subs, "-vf", f"subtitles='{ass_escaped}':force_style='{style}'", "-c:a", "copy", output_path], capture

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
import edge_tts
    except ImportError:
        print("Installing edge-tts...")
        os.system(f"{sys.executable} -m pip install edge-tts -q")
        import edge_tts

    os.makedirs(os.path.dirname(output_path) or ".", exist_ok=True)
Confidence
95% confidence
Finding
os.system(f"{sys.executable} -m pip install edge-tts -q")

subprocess module call

Medium
Category
Dangerous Code Execution
Content
image_data = img_resp.read()
    except Exception:
        import subprocess
        subprocess.check_call(
            ["curl", "-s", "-L", "-o", output_path, "--max-time", "60", image_url],
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
        )
Confidence
87% confidence
Finding
subprocess.check_call( ["curl", "-s", "-L", "-o", output_path, "--max-time", "60", image_url], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, )

subprocess module call

Medium
Category
Dangerous Code Execution
Content
except ImportError:
        import subprocess
        print("正在安装 google-genai pillow...")
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "google-genai", "pillow", "-q"],
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
        )
Confidence
93% confidence
Finding
subprocess.check_call( [sys.executable, "-m", "pip", "install", "google-genai", "pillow", "-q"], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, )

subprocess module call

Medium
Category
Dangerous Code Execution
Content
except ImportError:
            import subprocess
            print("正在安装 volcengine-python-sdk...")
            subprocess.check_call(
                [sys.executable, "-m", "pip", "install",
                 "volcengine-python-sdk[ark]", "httpx", "-q"],
                stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
Confidence
93% confidence
Finding
subprocess.check_call( [sys.executable, "-m", "pip", "install", "volcengine-python-sdk[ark]", "httpx", "-q"], stdout=subprocess.DEVNULL, st

Tainted flow: 'req' from os.environ.get (line 389, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
}).encode()

    req = urllib.request.Request(url, data=data, headers={"Content-Type": "application/json"}, method="POST")
    with urllib.request.urlopen(req) as resp:
        result = json.loads(resp.read())

    image_data = base64.b64decode(result["images"][0])
Confidence
88% confidence
Finding
with urllib.request.urlopen(req) as resp:

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
A TTS generation script unexpectedly performs package installation and shell execution as part of normal operation. That behavior expands the trust boundary from local processing into environment mutation and remote code acquisition, increasing supply-chain and execution risk beyond the script's stated purpose.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README explicitly instructs users to run `compose_video.py` outside the sandbox to bypass resource limits, but it does not provide a clear security warning or least-privilege guidance. Encouraging sandbox bypass normalizes executing project code with fewer protections, increasing the risk that users run unreviewed code with full local access.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger words are very broad generic phrases like 'book video' and 'book summary', which can cause the skill to activate on ordinary user requests that did not intend to invoke this workflow. In a multi-skill agent environment, this can lead to unintended execution of a pipeline that performs web searches, external AI calls, and file generation without clear user consent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill performs multiple external network calls to search engines and third-party AI providers for LLM, image generation, and TTS, but the description does not clearly warn users up front that their inputs may be sent off-platform. This creates a privacy and consent risk because book requests, prompts, and generated content may be disclosed to external services unexpectedly.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The workflow creates and saves a video draft through external plugins, but the user-facing start node and surrounding flow do not clearly disclose that a persistent artifact will be created and stored. This can surprise users, create unwanted records tied to an account/user_id, and lead to privacy or operational issues if users did not intend to trigger external draft creation.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The workflow sends user-derived text, generated content, images, and audio to multiple external plugins and hosted asset URLs without clear disclosure at input time. Even if these services are expected for video generation, the absence of transparency increases privacy and data-handling risk because users may not realize their content is being transmitted to third-party components.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script automatically installs a package if import fails, without requiring explicit opt-in or warning about the security implications. This can surprise users, alter system state, and execute unreviewed third-party package installation logic on the host.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The code sends user-provided text to external TTS providers, which may include sensitive or proprietary content, but the script does not prominently disclose this data egress at the point of use. In a skill context, hidden transmission of user content to third parties is a real privacy/security concern, especially when batch mode may process large amounts of text.

Unvalidated Output Injection

High
Category
Output Handling
Content
f.write(f"file '{cf}'\n")

    no_subs = os.path.join(tmpdir, "no_subs.mp4")
    subprocess.run(
        [FFMPEG, "-y", "-f", "concat", "-safe", "0", "-i", concat_list,
         "-c", "copy", no_subs],
        capture_output=True, check=True,
Confidence
95% confidence
Finding
subprocess.run( [FFMPEG, "-y", "-f", "concat", "-safe", "0", "-i", concat_list, "-c", "copy", no_subs], capture_output

Unvalidated Output Injection

High
Category
Output Handling
Content
if need_mix:
        # 先烧录字幕到临时文件，再混音
        subs_output = os.path.join(tmpdir, "with_subs.mp4")
        subprocess.run(
            [FFMPEG, "-y", "-i", no_subs, "-vf",
             f"subtitles='{ass_escaped}':force_style='{style}'",
             "-c:a", "copy", subs_output],
Confidence
97% confidence
Finding
subprocess.run( [FFMPEG, "-y", "-i", no_subs, "-vf", f"subtitles='{ass_escaped}':force_style='{style}'", "-c:a", "copy", subs_output], capture_output

Unvalidated Output Injection

High
Category
Output Handling
Content
)
    else:
        # 无混音，直接烧录字幕到最终输出
        subprocess.run(
            [FFMPEG, "-y", "-i", no_subs, "-vf",
             f"subtitles='{ass_escaped}':force_style='{style}'",
             "-c:a", "copy", output_path],
Confidence
97% confidence
Finding
subprocess.run( [FFMPEG, "-y", "-i", no_subs, "-vf", f"subtitles='{ass_escaped}':force_style='{style}'", "-c:a", "copy", output_path], capture_output

Unvalidated Output Injection

High
Category
Output Handling
Content
image_data = img_resp.read()
    except Exception:
        import subprocess
        subprocess.check_call(
            ["curl", "-s", "-L", "-o", output_path, "--max-time", "60", image_url],
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
        )
Confidence
84% confidence
Finding
subprocess.check_call( ["curl", "-s", "-L", "-o", output

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/generate_image.py:144