ClawHub
Back to skill

Security audit

AITuber AI Video Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but users should review it because its install instructions run unpinned third-party packages and its API workflow can spend account credits without explicit confirmation guidance.

Install only from a reviewed, pinned version or use the manual SKILL.md install path. Treat AITUBER_API_KEY as an account credential, confirm before generating videos that consume credits, and change the output filename if video.mp4 already exists.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:24
Finding

Unpinned Third-Party Installer and Mutable Remote Skill Source

Content
View full analysis

Vulnerability Details

File Location: README.md, line 24
Vulnerability Type: Unpinned third-party dependency and mutable remote source
Risk Level: Medium

bash
npx skills add aituberapp/ai-video-skill

Technical Analysis

The documented installation command invokes npx without pinning the skills package to a reviewed version. Depending on the local environment and npm cache state, npx may retrieve and execute the latest available package release. The repository shorthand aituberapp/ai-video-skill also identifies mutable remote content rather than a specific reviewed commit.

Consequently, the code executed by the installer and the Skill content ultimately installed can change after this repository has been audited. Neither the installer implementation nor its dependency tree is included in the audited project, so their security cannot be established from the available files. This creates a supply-chain trust boundary in which a compromised npm release, transitive dependency, package ownership change, or remote repository revision could introduce attacker-controlled behavior.

The audit did not establish that the current package or repository is malicious. The vulnerability is the unsafe reliance on unpinned, remotely mutable components during installation.

Attack Path

  1. An attacker compromises the skills npm package, one of its dependencies, its publishing credentials, or the referenced remote repository.
  2. The attacker publishes a malicious package version or modifies the repository content resolved by aituberapp/ai-video-skill.
  3. A user follows the README and runs npx skills add aituberapp/ai-video-skill.
  4. npx retrieves the unpinned installer package, or uses an unreviewed version not covered by this audit.
  5. The installer runs with the invoking user's privileges and retrieves mutable Skill content.
  6. Malicious installer code could execute immediately, or altered Skill in ...[truncated 914 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the npm installer to an exact, reviewed version, for example:

    bash
    npx --yes skills@<reviewed-exact-version> add ...

    Do not use version ranges or tags such as latest.

  2. Pin the Skill source to a specific reviewed commit rather than a branch or repository shorthand. Document the expected commit identifier.

  3. Publish and verify cryptographic integrity information for the installer and downloaded Skill content. Where supported, use npm provenance, signed releases, checksums, or Sigstore-based verification.

  4. Review and lock the installer's complete dependency tree. Use a lockfile and automated dependency monitoring, and prevent unexpected lifecycle scripts where practical.

  5. Make the non-executing manual installation method the preferred approach. Instruct users to download a specific release or commit, verify its checksum, inspect SKILL.md, and then copy it into the appropriate Skill directory.

  6. Recommend executing installation in a restricted environment without unnecessary credentials or elevated privileges. Users should not run the command as root or with administrator permissions.

  7. Update the documentation to explain that npx executes third-party code and that repository branches are mutable, enabling users to make an informed trust decision.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The README instructs users to run npx skills add aituberapp/ai-video-skill without pinning a version or commit. This allows the latest published package or fetched content to change over time, creating a supply-chain risk where users may unknowingly install modified or compromised code or skill content.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The command npx -y @aituber/mcp-server runs the latest MCP server package directly from the registry without version pinning. Because this is executable code rather than just documentation text, a compromised package, dependency, or account could lead to arbitrary code execution on the user's machine or in the agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The command npx -y @aituber/mcp-server runs the latest MCP server package directly from the registry without version pinning. Because this is executable code rather than just documentation text, a compromised package, dependency, or account could lead to arbitrary code execution on the user's machine or in the agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README describes endpoints that can generate videos, export renders, and access subscription or billing-related information, but it does not warn users or agent developers about consent, cost, privacy, or account-impacting effects. In an agent-skill context, this omission is risky because an autonomous agent may perform paid or sensitive actions without explicit user confirmation or clear disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
env:
        - AITUBER_API_KEY
      bins:
        - curl
---

# AITuber API

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 258)May include surrounding context.

md
curl -s "https://app.aituber.app/api/v1/voices?gender=female&useCase=narration" | jq '.[0:3]'

# 3. Generate video
VIDEO_ID=$(curl -s -X POST "https://app.aituber.app/api/v1/videos/generate" \
  -H "Authorization: Bearer $AITUBER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

md
done

# 5. Export to MP4
curl -s -X POST "https://app.aituber.app/api/v1/exports" \
  -H "Authorization: Bearer $AITUBER_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"videoId\": \"$VIDEO_ID\"}"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This markdown file includes a concrete example that writes video.mp4 to the local filesystem via curl -L -o video.mp4, but it does not explicitly warn that the command will create or overwrite a local file. For markdown skills, SQP-2 applies when descriptions omit warnings about behavior that could affect user data or system state, and the download/write behavior is user-impacting enough to merit a brief disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.