ClawHub
Back to skill

Security audit

Cn Video Gen

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real AI-video helper, but it needs Review because it can upload local files to a public image host using embedded credentials without enough scoping or warnings.

Review before installing. Use only non-sensitive image files, assume uploaded images may become publicly reachable or retained by a third party, replace or remove the embedded ImgURL credential, and avoid invoking the uploader on arbitrary paths until file validation, size limits, workspace restrictions, and explicit confirmation are added.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/upload_image.py:13
Finding

Hard-Coded Third-Party Upload Credential

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/upload_image.py:17
Finding

Arbitrary Local Files Can Be Uploaded to a Third-Party Public Host

Content
View full analysis
str: """上传图片到 ImgURL，返回公网直链 URL""" boundary = "----FormBoundary7MA4YWxkTrZu0gW" with open(image_path, "rb") as f: file_data = f.read() filename = os.path.basename(image_path) body = ( f"--{boundary}\r\n" f'Content-Disposition: form-data; name="uid"\r\n\r\n' f"{IMGURL_UID}\r\n" f"--{boundary}\r\n" f'Content-Disposition: form-data; name="token"\r\n\r\n' f"{IMGURL_TOKEN}\r\n" f"--{boundary}\r\n" f'Content-Disposition: form-data; name="file"; filename="{filename}"\r\n' f"Content-Type: image/png\r\n\r\n" ).encode() + file_data + f"\r\n--{boundary}--\r\n".encode() req = urllib.request.Request( IMGURL_API, data=body, headers={"Content-Type": f"multipart/form-data; boundary={boundary}"}, method="POST" ) ``` ```python if __name__ == "__main__": if len(sys.argv) < 2: print("用法: python3 upload_image.py <图片路径>", file=sys.stderr) sys.exit(1) image_path = sys.argv[1] if not os.path.exists(image_path): print(f"❌ 文件不存在: {image_path}", file=sys.stderr) sys.exit(1) print(f"📤 上传图片: {image_path}") url = upload_image(image_path) print(f"✅ 上传成功: {url}") print(url) ``` ### Technical Analysis The script accepts an arbitrary caller-supplied filesystem path and only checks whether that path exists. It does not verify that the selected object is a regular image file. The complete contents are read and sent to `https://www.imgurl.org/api/v2/upload`, while the multipart request unconditionally labels the data as `image/png`. The following controls are absent: - Image decoding and format verification. - MIME-type and extension ...[truncated 2670 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)

Tainted flow: 'req' from os.environ.get (line 128, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate.py (reported line 118)May include surrounding context.

python
req = urllib.request.Request(url, data=data, headers=headers, method="POST")
    
    try:
        with urllib.request.urlopen(req) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        body = e.read().decode("utf-8")

Tainted flow: 'req' from os.environ.get (line 128, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate.py (reported line 131)May include surrounding context.

python
req = urllib.request.Request(url, data=data, headers=headers, method="POST")
    
    try:
        with urllib.request.urlopen(req) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        body = e.read().decode("utf-8")

Tainted flow: 'req' from os.environ.get (line 39, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/upload_image.py (reported line 47)May include surrounding context.

python
)

    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            result = json.loads(resp.read().decode())
            if result.get("code") == 200:
                url = result["data"]["url"]

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill claims to be a video-generation helper, but its instructions include uploading local images to a third-party image host and using credentials for API access without clearly presenting those data-transfer risks in the declared behavior. In a skill handling user media, undeclared outbound transmission is especially sensitive because local files may contain private or proprietary content.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill claims to be a video-generation helper, but its instructions include uploading local images to a third-party image host and using credentials for API access without clearly presenting those data-transfer risks in the declared behavior. In a skill handling user media, undeclared outbound transmission is especially sensitive because local files may contain private or proprietary content.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill documents use of environment variables, external APIs, image upload, and file transfer, but does not declare any tool scope or permission boundaries. This makes the skill harder to audit and increases the chance an agent can access network or secrets more broadly than users expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to upload local images to a public image host to obtain a URL, but gives no warning that the image may become publicly accessible or retained by a third party. This can expose sensitive personal, internal, or copyrighted images beyond the user's intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advises downloading generated videos locally and sending them to Feishu without warning about local storage, retention, or third-party transmission. This can leak sensitive generated content or metadata and may leave residual files on disk after transfer.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
**文档：** https://klingai.kuaishou.com/api/docs

**端点：** `https://api.klingai.com/v1/videos/text2video`

**认证：** 需要 JWT Token（用 Access Key + Secret Key 生成）

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring presents the script name, supported features, and usage instructions only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly justified, which is not provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Argument help text, validation errors, and status output are all emitted in Chinese, with no option to choose another language. This enforces a single language for operation and troubleshooting, which matches the language/locale policy violation described in SQP-3.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This skill is presented as a video-generation capability, but the file implements image upload to a public hosting provider. That scope expansion matters because it introduces data exfiltration/public-publication behavior that a user invoking a video tool may not reasonably expect, increasing the chance that local images are exposed externally without informed consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script contains built-in fallback API credentials, including what appears to be a live token, and uses them automatically if environment variables are absent. Hardcoded secrets can be abused by anyone with access to the code, may incur unauthorized usage/costs, and indicate poor secret-management hygiene in a component that transmits data to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script uploads a user-specified local file to a public image-hosting service and returns a public URL, but there is no explicit privacy warning or consent gate. In the context of an AI media skill, users may provide personal, proprietary, or sensitive images, so silent public disclosure materially increases the risk of accidental data exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description says the skill triggers when the user asks to generate a video, turn an image into a dynamic video, or generate clips from storyboard descriptions, but it does not define clear boundaries or exclusions. Phrases like '要求生成视频' are broad enough to match many ordinary creative requests, which could cause unintended invocation without more specific trigger constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The script accesses upload credentials without any user-facing disclosure, which reduces transparency around third-party service use and account context. While less severe than the hardcoded-secret issue, hidden credential use can mislead operators about which external account receives uploaded content and can complicate accountability and incident response.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.