ClawHub
Back to skill

Security audit

Jarvis-Video-STT

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate local video transcription skill, but it has an unsafe shell command that could run unintended commands if given a crafted video filename.

Review before installing. Use only trusted local video files with ordinary filenames, choose a dedicated output folder, and avoid confidential recordings unless you are comfortable with transcripts being saved locally. The script should be fixed to call ffmpeg via subprocess with an argument list instead of os.system before processing untrusted filenames.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
"""提取音频到临时文件"""
    audio_path = os.path.join(temp_dir, f"{Path(video_path).stem}.wav")
    cmd = f'ffmpeg -y -i "{video_path}" -vn -acodec pcm_s16le -ar 16000 -ac 1 "{audio_path}" 2>/dev/null'
    os.system(cmd)
    return audio_path if os.path.exists(audio_path) else None
Confidence
98% confidence
Finding
The code builds a shell command with f-string interpolation of user-controlled paths and executes it with os.system(). Even though the paths are wrapped in double quotes, shell metacharacters such as embedded quotes can break out of the intended argument and lead to command injection, allowing arbitrary command execution under the user's privileges.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill clearly instructs users to run a Python script that reads input videos, writes transcripts/reports, and relies on shell execution, yet no permissions are declared. This creates a transparency and trust problem: users and hosting systems cannot accurately assess or constrain the skill's file and command execution capabilities before use.

Missing User Warnings

Low
Confidence
86% confidence
Finding
The skill documentation describes outputs but does not clearly warn that execution will create multiple files in the chosen output directory for each processed video plus summary reports. This can lead to unintended overwrites, storage consumption, or writing sensitive transcripts to locations the user did not realize would be populated.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill processes audio from videos into text transcripts and machine-readable reports, but the description does not warn that potentially sensitive spoken content will be extracted and persisted to disk. In practice, this increases the risk of accidental disclosure of private conversations, regulated data, or confidential media content through transcript files and summary artifacts.

Static analysis

No suspicious patterns detected.