ClawHub
Back to skill

Security audit

Video Creator

Security checks for vulnerabilities and agentic risk

Overview

This video skill appears purpose-built, but it needs review because it can upload voice and portrait media, persist voice/API data, install packages at runtime, and delete a user-chosen output directory.

Review this before installing, especially on shared or sensitive machines. Only use it with voice samples and portraits you are authorized to process, expect uploads to platform.delilegal.com/OSS for remote AI features, preinstall dependencies through a controlled setup, keep --output inside a dedicated disposable folder, and avoid storing real API keys in plaintext config unless that is acceptable for your environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
92% confidence
Finding

The code automatically invokes pip at runtime via a subprocess when httpx is missing. Executing package installation during normal skill operation expands the attack surface, can pull code from external package indexes without explicit approval, and creates a code-execution path controlled by the runtime environment and dependency resolution.

Content

Scanner excerpt · scripts/dashscope_api.py (reported line 91)May include surrounding context.

python
import httpx  # noqa: F811
        return httpx
    except ImportError:
        subprocess.run(
            [sys.executable, "-m", "pip", "install", "httpx", "certifi", "-q"],
            check=True,
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The script installs Python packages at runtime via pip when imports fail. This creates a supply-chain and execution risk because code is fetched and executed dynamically during normal operation, and it can also modify the host environment without prior approval. In a skill context, automatic dependency installation is more dangerous because the agent may run in shared or sensitive environments.

Content

Scanner excerpt · scripts/enroll_my_voice.py (reported line 58)May include surrounding context.

python
except ImportError:
        log("httpx 或 certifi 未安装，正在安装...", "WARN")
        import subprocess
        subprocess.run([sys.executable, "-m", "pip", "install", "httpx", "certifi", "-q"], check=True)
        import httpx
        import certifi

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
96% confidence
Finding

The script automatically installs Python packages at runtime with pip when imports fail. In an agent/skill context this is dangerous because execution can fetch and execute unpinned third-party code from external package repositories, expanding the trust boundary and enabling supply-chain compromise or environment tampering.

Content

Scanner excerpt · scripts/generate_video.py (reported line 207)May include surrounding context.

python
import certifi
        import hashlib
    except ImportError:
        subprocess.run([sys.executable, "-m", "pip", "install", "requests", "certifi", "-q"], check=True)
        import requests as _requests
        import certifi
        import hashlib

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
96% confidence
Finding

This code auto-installs edge-tts at runtime via pip. A skill that self-modifies its environment by downloading executable dependencies during execution can be abused through package supply-chain attacks and breaks the expectation that the skill only processes user media.

Content

Scanner excerpt · scripts/generate_video.py (reported line 681)May include surrounding context.

python
import edge_tts
    except ImportError:
        log("edge-tts 未安装，正在安装...", "WARN")
        subprocess.run([sys.executable, "-m", "pip", "install", "edge-tts", "-q"], check=True)
        import edge_tts

    if gender == "male" and lang in EDGE_TTS_MALE_VOICES:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
96% confidence
Finding

The script installs requests dynamically during execution if it is missing. Runtime dependency installation introduces remote code execution risk through package retrieval and allows the skill to change the host environment without explicit consent.

Content

Scanner excerpt · scripts/generate_video.py (reported line 1479)May include surrounding context.

python
from dashscope_api import generate_image as api_gen_image
        import requests as _reqs
    except ImportError:
        subprocess.run([sys.executable, "-m", "pip", "install", "requests", "-q"], check=True)
        import requests as _reqs
        sys.path.insert(0, str(Path(__file__).parent))
        from dashscope_api import generate_image as api_gen_image

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
96% confidence
Finding

Automatically installing Pillow during execution exposes the host to supply-chain risk and unreviewed code execution. In a media-processing skill this is especially risky because the behavior is hidden behind normal fallback logic and may occur unexpectedly on first run.

Content

Scanner excerpt · scripts/generate_video.py (reported line 1550)May include surrounding context.

python
try:
        from PIL import Image, ImageDraw, ImageFont
    except ImportError:
        subprocess.run([sys.executable, "-m", "pip", "install", "Pillow", "-q"], check=True)
        from PIL import Image, ImageDraw, ImageFont

    images = []

Tainted flow: 'upload_url' from requests.post (line 249, network input) → requests.put (network output)

Medium
Category
Data Flow
Confidence
88% confidence
Finding

The upload URL used for PUT is taken directly from a prior network response and then sent the full local file contents. If the upstream platform or response is compromised, the skill will exfiltrate user media to an attacker-controlled destination, creating an SSRF-like trusted redirect for data upload.

Content

Scanner excerpt · scripts/generate_video.py (reported line 263)May include surrounding context.

python
put_headers["Content-Type"] = "application/octet-stream"
        with open(local_path, "rb") as f:
            file_data = f.read()
        resp2 = _requests.put(upload_url, headers=put_headers, data=file_data, timeout=180)
        if resp2.status_code not in (200, 204):
            raise RuntimeError(f"[步骤二] 上传到 OSS 失败（{resp2.status_code}）：{resp2.text[:200]}")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents capabilities to read/write local files, access environment variables, invoke shell commands, and make network requests, but it does not declare permissions accordingly. This weakens user/admin visibility into what the skill can do and increases the chance that sensitive files, secrets, or user media are accessed or exfiltrated without informed approval.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documented behavior materially exceeds the stated purpose: it can upload local audio/photos to external services and generate media remotely, not merely assemble user-provided images into a local slideshow video. This creates a significant transparency and data-handling risk because users may provide sensitive voice samples or portraits without realizing they will be transmitted to third-party infrastructure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The documentation is internally inconsistent about whether voice identifiers are persisted: one section shows voice_id stored in configuration, while another says voice_id is only valid for the current run and is not written to config. For voice-cloning workflows, this ambiguity can cause unsafe handling of reusable biometric-derived identifiers and mislead users about persistence and privacy exposure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The API-key instructions conflict on whether the skill must halt without an API key or may continue in degraded mode using edge-tts/Pillow. Contradictory security and execution guidance can cause operators or agents to take unintended branches, including invoking networked services without clear authorization expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill claims it does not rely on large-model video generation for cost control, yet later describes model-based image generation and talking-head video generation through wan2.7 services. This is a misleading representation of processing behavior that can hide privacy, compliance, and cost implications from users and reviewers.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Runtime package installation is not necessary for the core purpose of this skill and introduces an avoidable supply-chain and command-execution risk. Even though the command arguments are static, fetching and installing packages during execution can lead to unreviewed code being installed in the agent environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script's runtime dependency installation is unnecessary for its core purpose and introduces avoidable risk. Pulling packages during execution increases exposure to package-repo compromise, dependency confusion, and unauthorized environment changes, especially in automated agent execution paths.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill metadata says it creates slideshow videos from user-provided images, but the code can silently generate missing or all images from script text using remote image-generation APIs. This is a security-relevant capability mismatch because it causes unadvertised external transmission of user content and changes the data-processing behavior materially.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest does not disclose that local audio files and portrait images are uploaded to an external OSS/platform service. In a voice-cloning/video skill this is especially sensitive because user biometrics and personal media are transmitted off-host, which creates privacy, consent, and data-governance risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation claims cloned voice IDs are only used in memory and not written to disk, but later code persists the voice_id to voice_config.json. This mismatch can mislead users and operators about retention of biometric-related identifiers and creates a privacy/security issue through unexpected persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs uploading user photos and audio to platform.delilegal.com and OSS for processing but does not provide an explicit privacy warning or consent step before transfer. Because portraits and voice recordings are sensitive personal data, silent upload to third-party services materially increases privacy, compliance, and misuse risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill advertises voice cloning without a prominent warning that it processes biometric-like voice samples and can create reusable synthetic voice output. Voice cloning is highly sensitive and can enable impersonation, fraud, and long-term misuse if users do not fully understand the consequences and consent boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill performs an external side effect—installing software—without any user-facing warning or confirmation. Silent package installation reduces transparency and can violate execution expectations, especially in constrained or high-trust agent environments where subprocess execution should be explicit and controlled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

When --audio-file is used, the script base64-encodes local audio and transmits it to a remote enrollment endpoint, but it provides no explicit warning, consent checkpoint, or data-handling notice. Because voice samples are sensitive biometric-like data, silent transfer to a third-party platform materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The code writes API credentials to a local JSON config file without any explicit warning, encryption, permission hardening, or secret-store integration. On shared systems or agent hosts this can expose reusable platform credentials to other users or processes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Local audio is uploaded to a remote platform service without an explicit privacy warning or consent checkpoint. Because this skill performs voice cloning, the uploaded audio may contain sensitive biometric voice data, making undisclosed transmission materially more dangerous than ordinary media processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script recursively deletes the entire output directory if it already exists, with no confirmation prompt or allowlist. Because the output path is user-controlled, a mistaken or maliciously influenced path could lead to destructive data loss of arbitrary directories accessible to the process.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This network call sends file metadata to an external service as part of an upload workflow. External transmission is expected for the feature, but it is security-relevant because the skill does not prominently disclose these uploads in metadata or require explicit user approval for sensitive media.

Content

Scanner excerpt · scripts/generate_video.py (reported line 240)May include surrounding context.

python
save_url = "https://platform.delilegal.com/api/v1/file/saveFile"

    # 步骤一：获取上传临时链接
    resp1 = _requests.post(
        prepare_url,
        headers=platform_headers,
        json={"fileHash": file_hash, "fileName": file_name},

Static analysis

No suspicious patterns detected.