ClawHub
Back to skill

Security audit

Video News Downloader

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says at a high level, but it can expose downloaded files over the network and install persistent cron jobs without enough user-facing safeguards.

Review before installing. Run it as an unprivileged user, bind the HTTP server to 127.0.0.1 unless LAN sharing is intentional, inspect any crontab changes before installing them, pin dependencies in a virtual environment, and treat subtitle text sent to DeepSeek or another AI provider as third-party data sharing.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/setup_server.sh:40
Finding

Unauthenticated HTTP File Exposure on All Network Interfaces

Content
View full analysis
/dev/null 2>&1 & ``` ### Technical Analysis The script starts Python's general-purpose directory server and binds it to `0.0.0.0`, making it reachable through every network interface. The server provides neither authentication nor transport encryption and normally permits directory listing. The declared functionality includes local video streaming, but binding to every interface is broader than necessary for local access. The directories being served may contain videos, subtitle files, source URL records, proofreading prompts, correction reports, and any future files created in those directories. The script does not configure firewall restrictions, an IP allowlist, an authentication layer, or a restricted set of files that may be downloaded. ### Attack Path 1. An operator runs `bash scripts/setup_server.sh start`. 2. The script starts HTTP servers on ports 8093 and 8095, bound to all interfaces. 3. An attacker with network access to the host connects to either exposed port. 4. The attacker requests the directory root or guesses documented filenames. 5. Python's HTTP server returns directory listings and readable files under the corresponding media directory. 6. The attacker downloads exposed videos, subtitles, proofreading artifacts, source URLs, or other files placed there. ### Impact Assessment An unauthenticated remote user can read all files accessible to the server process beneath the two served directories. The vulnerability does not directly grant command execution or filesystem write access, but it may disclose copyrighted media, generated AI prompts, subtitle content, operational metadata, and accidentally stored sensitive files. If the host is directly ...[truncated 134 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/setup_server.sh:17
Finding

Stop and Restart Commands Can Terminate Unrelated Processes

Content
View full analysis
/dev/null } stop_server() { local port=$1 local name=$2 pid=$(get_server_pid $port) if [ -n "$pid" ]; then kill $pid 2>/dev/null sleep 1 if [ -z "$(get_server_pid $port)" ]; then echo -e "${GREEN}✅ $name stopped (port $port)${NC}" else echo -e "${RED}❌ Failed to stop $name${NC}" fi else echo -e "${YELLOW}$name is not running (port $port)${NC}" fi } ``` ### Technical Analysis The script identifies a server exclusively by the local port it occupies. It does not verify that the returned PID belongs to a `python3 -m http.server` process previously launched by this Skill. Consequently, `stop` and `restart` may send `SIGTERM` to any process using port 8093 or 8095. If `lsof` returns multiple PIDs, shell word splitting can cause `kill` to target all of them. The impact is constrained by the privileges of the user running the script. However, the project uses hardcoded `/root/.openclaw` paths and is likely to be run with elevated privileges, in which case unrelated privileged services may be affected. ### Attack Path 1. A legitimate or attacker-controlled service listens on port 8093 or 8095. 2. An operator invokes `bash scripts/setup_server.sh stop` or `restart`. 3. `lsof` returns the PID of the existing service. 4. The script assumes that the PID belongs to its own HTTP server. 5. The script sends `SIGTERM` to that unrelated process. 6. The unrelated service is disrupted; during restart, the Skill may subsequently claim the freed port. ### Impact Assessment The vulnerability can cause local denial of service against processes that share either configured port. When the script is run ...[truncated 306 chars]
Remediation
View remediation
"$pid_file" ``` 2. Before terminating a PID, verify: - The PID file is owned by the expected user. - The process still exists. - `/proc/$pid/cmdline` matches the expected Python HTTP server command. - `/proc/$pid/cwd` matches the intended media directory. - The process owner matches the service user. 3. Refuse to stop a process when any identity check fails. 4. Run each server as a dedicated, unprivileged account. 5. Prefer a user-level service manager with explicit unit identity and lifecycle controls. 6. Quote variables and validate PIDs as a single numeric value before passing them to `kill`. ]]>

T01 · Skill Instruction Hijacking

Warning
Location
scripts/subtitle_proofreader.py:50
Finding

Downloaded Subtitle Content Can Inject Instructions into the AI Proofreading Prompt

Content
View full analysis
Remediation
View remediation
... ``` 4. Use separate system and user messages when invoking an AI API, keeping security instructions outside attacker-controlled content. 5. Require a strict structured response schema and reject output that does not conform. 6. Prevent model output from being interpreted as commands or automatically executed. 7. Record the source video URL and verified publisher metadata with each proofreading task for review. ]]>

T08 · Insecure Dependencies

Warning
Location
references/workflow.md:168
Finding

Documentation Recommends an Unpinned Privileged Package Upgrade

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (31)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented behavior claims a broad automation pipeline, including downloading, serving over HTTP, cron scheduling, and AI proofreading, but the analysis indicates the actual implementation does not fully perform those functions. This mismatch is dangerous because users and agents may trust the skill to behave in one way while hidden or incomplete behavior causes unsafe assumptions, incorrect approval decisions, or accidental execution of unsupported steps.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/subtitle_proofreader.py (reported line 89)May include surrounding context.

python
Returns: (prompt, word_count)
    """
    prompt = generate_deepseek_prompt(text, source_name)
    return prompt, len(text.split())

def save_results(vtt_path, corrections, corrected_text):
    """Save proofreading results"""

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill instructs use of shell commands, file reads/writes, local HTTP serving, and cron setup, but it does not declare any tool scope or permissions. This creates a transparency and consent problem: an agent or user may invoke filesystem and shell-capable behavior without an explicit security boundary, increasing the chance of unintended system modification or exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill promotes AI subtitle proofreading but does not clearly warn that subtitle content may be sent to DeepSeek or another external AI service. That omission can lead to unintentional disclosure of potentially sensitive or copyrighted transcript content to a third party, especially in environments where outbound data sharing requires approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs users to start HTTP servers and lists network-accessible endpoints, but it does not warn that this exposes downloaded media on the local network. Users may unintentionally publish files to other hosts on the same network, creating confidentiality and policy risks if the content should remain local.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cron-setup.md (reported line 22)May include surrounding context.

bash
# Edit crontab
crontab -e

# Add these lines:
# Video download at 20:00 Beijing Time (12:00 UTC)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The workflow explicitly states that subtitle text is sent to DeepSeek for proofreading, but it does not warn users that subtitle content will be transmitted to a third-party AI service. Even though news subtitles are often low sensitivity, the omission creates a privacy and data-handling transparency issue, especially if users adapt the skill to other video sources or process copyrighted, private, or regulated content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script performs persistent system-scheduling changes by writing to the current user's crontab in both the install and remove branches. While it prints status messages, it does not warn the user before making the change or explain the impact of overwriting scheduled entries matching these patterns.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cron-setup.md (reported line 66)May include surrounding context.

md
echo "Installing video download cron jobs..."
        
        # Add video download job
        (crontab -l 2>/dev/null | grep -v "video_download.py"; echo "$VIDEO_CRON") | crontab -
        
        # Add proofreading job  
        (crontab -l 2>/dev/null | grep -v "subtitle_proofreader.py"; echo "$PROOFREAD_CRON") | crontab -

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/cron-setup.md (reported line 96)May include surrounding context.

md
echo "Installing video download cron jobs..."
        
        # Add video download job
        (crontab -l 2>/dev/null | grep -v "video_download.py"; echo "$VIDEO_CRON") | crontab -
        
        # Add proofreading job  
        (crontab -l 2>/dev/null | grep -v "subtitle_proofreader.py"; echo "$PROOFREAD_CRON") | crontab -

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup_cron.sh (reported line 22)May include surrounding context.

sh
echo "Installing video download cron jobs..."
        
        # Add video download job
        (crontab -l 2>/dev/null | grep -v "video_download.py"; echo "$VIDEO_CRON") | crontab -
        
        # Add proofreading job  
        (crontab -l 2>/dev/null | grep -v "subtitle_proofreader.py"; echo "$PROOFREAD_CRON") | crontab -

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup_cron.sh (reported line 25)May include surrounding context.

sh
echo "Installing video download cron jobs..."
        
        # Add video download job
        (crontab -l 2>/dev/null | grep -v "video_download.py"; echo "$VIDEO_CRON") | crontab -
        
        # Add proofreading job  
        (crontab -l 2>/dev/null | grep -v "subtitle_proofreader.py"; echo "$PROOFREAD_CRON") | crontab -

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup_cron.sh (reported line 33)May include surrounding context.

sh
echo "Installing video download cron jobs..."
        
        # Add video download job
        (crontab -l 2>/dev/null | grep -v "video_download.py"; echo "$VIDEO_CRON") | crontab -
        
        # Add proofreading job  
        (crontab -l 2>/dev/null | grep -v "subtitle_proofreader.py"; echo "$PROOFREAD_CRON") | crontab -

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup_cron.sh (reported line 38)May include surrounding context.

sh
echo "Installing video download cron jobs..."
        
        # Add video download job
        (crontab -l 2>/dev/null | grep -v "video_download.py"; echo "$VIDEO_CRON") | crontab -
        
        # Add proofreading job  
        (crontab -l 2>/dev/null | grep -v "subtitle_proofreader.py"; echo "$PROOFREAD_CRON") | crontab -

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup_cron.sh (reported line 45)May include surrounding context.

sh
echo "Installing video download cron jobs..."
        
        # Add video download job
        (crontab -l 2>/dev/null | grep -v "video_download.py"; echo "$VIDEO_CRON") | crontab -
        
        # Add proofreading job  
        (crontab -l 2>/dev/null | grep -v "subtitle_proofreader.py"; echo "$PROOFREAD_CRON") | crontab -

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup_server.sh (reported line 40)May include surrounding context.

sh
fi
    
    # Start server
    cd "$dir" && nohup python3 -m http.server $port --bind 0.0.0.0 > /dev/null 2>&1 &
    sleep 1
    
    # Verify started

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script starts Python's built-in HTTP server bound to 0.0.0.0, making the video directories reachable from any network interface rather than only localhost. In this skill's context, the served directories contain downloaded media and subtitle files under /root paths, so an operator may unintentionally expose local content to other machines on the network without authentication or an explicit warning.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_download.py (reported line 38)May include surrounding context.

python
"--print", "%(url)s", CBS_PLAYLIST
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
        video_url = result.stdout.strip()
        if not video_url:
            print("❌ Could not get CBS video URL")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_download.py (reported line 84)May include surrounding context.

python
"--print", "%(url)s", CBS_PLAYLIST
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
        video_url = result.stdout.strip()
        if not video_url:
            print("❌ Could not get CBS video URL")

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The downloader explicitly requests only English subtitles via --sub-langs en, and the file's natural-language description and CLI do not offer any language/locale choice. This can violate language/locale policy because the skill forces a specific language behavior without user opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_download.py (reported line 61)May include surrounding context.

python
]
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
        if result.returncode == 0:
            print("✅ CBS download complete")
            # Backup original subtitle if exists

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_download.py (reported line 111)May include surrounding context.

python
]
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
        if result.returncode == 0:
            print("✅ CBS download complete")
            # Backup original subtitle if exists

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The BBC download path also forces English subtitles using --sub-langs en with no user-selectable locale option. Because the skill applies this language restriction unconditionally, it constitutes a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The cleanup feature performs deletion behavior that is not clearly described in the usage/docstring and may surprise users of a downloader tool. In an agent skill context, unexpected file deletion inside the workspace increases the chance of accidental data loss, especially if other files matching similar naming patterns are stored there.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_download.py (reported line 190)May include surrounding context.

python
print("\n🤖 Starting subtitle proofreading...")
        import subprocess
        if args.cbs and os.path.exists(f"{CBS_DIR}/cbs_latest.en.vtt"):
            subprocess.run([sys.executable, "scripts/subtitle_proofreader.py", 
                          f"{CBS_DIR}/cbs_latest.en.vtt"])
        if args.bbc and os.path.exists(f"{BBC_DIR}/bbc_news_latest.en.vtt"):
            subprocess.run([sys.executable, "scripts/subtitle_proofreader.py",

Static analysis

No suspicious patterns detected.