ClawHub
Back to skill

Security audit

主图视频 Main Image Video

Security checks for vulnerabilities and agentic risk

Overview

Review is needed because this video skill can use existing API credentials to send your image to a still-image service while ignoring your chosen video model.

Before running, explicitly select a video-capable provider and verify its actual model and endpoint with --dry-run. Do not assume DLAZY_VIDEO_MODEL controls every backend. Submitted images, prompts, and optional brand references go to the selected cloud provider; use approved content and verify the output is genuinely video before running a batch.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (22)

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
node scripts/video.mjs --mode clip --task main-image-video \

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
node scripts/video.mjs --mode clip --task main-image-video --image x.jpg \

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, network.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
| 图生视频 | 一张商品图 → 3–5 秒运动镜头 |
| 运镜控制 | 推、拉、环绕、俯仰、微距扫过 |
| 材质动态 | 面料飘动、金属反光扫过、液体晃动 |
| 批量 | 配合 [batch-image](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/batch-image/skill.md) 整批出 |

| 不能做 | 说明 |
| --- | --- |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
| 不能做 | 说明 |
| --- | --- |
| 长视频 | 超过 8 秒请用 [product-video-ad](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/product-video-ad/skill.md) 分镜串联 |
| 口播 | 用 [ugc-testimonial](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/ugc-testimonial/skill.md) |
| 改商品 | 视频模型会放大原图的瑕疵，先用 [item-repair](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/item-repair/skill.md) 修好 |

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md
## Tips

- **3 秒够用**。主图位视频不是广告片，讲清楚一个卖点就行。
- **别加文字**。主图视频的文字规则和主图一样严，字幕留给 [product-video-ad](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/product-video-ad/skill.md)。
- **首帧就是封面**。用商品最好看的角度做输入图，因为它大概率是静止时显示的那一帧。

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
| 不能做 | 说明 |
| --- | --- |
| 长视频 | 超过 8 秒请用 [product-video-ad](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/product-video-ad/skill.md) 分镜串联 |
| 口播 | 用 [ugc-testimonial](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/ugc-testimonial/skill.md) |
| 改商品 | 视频模型会放大原图的瑕疵，先用 [item-repair](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/item-repair/skill.md) 修好 |

---

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
| --- | --- |
| 长视频 | 超过 8 秒请用 [product-video-ad](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/product-video-ad/skill.md) 分镜串联 |
| 口播 | 用 [ugc-testimonial](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/ugc-testimonial/skill.md) |
| 改商品 | 视频模型会放大原图的瑕疵，先用 [item-repair](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/item-repair/skill.md) 修好 |

---

The video-generation workflow lacks an explicit disclosure that input images and prompts are sent to the configured model provider.

Medium
Category
Output Handling
Confidence
86% confidence
Finding

The workflow directs an initial generation run without explicitly explaining that the selected backend may receive the input image and prompt. For a remote provider, this can disclose unpublished product imagery, identifiable models, or confidential prompt content before the user understands the data transfer; explicit backend selection and the optional dry run reduce, but do not eliminate, this risk.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
3. **单张试跑**。视频比图贵得多，先跑一条 3 秒的看运镜对不对。
4. **确认后再批量**。
5. **过一遍平台规格**。视频也有规格要求（时长、比例、体积），
   目前 [platform-compliance](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/platform-compliance/skill.md) 只校验静态图，视频请人工对照平台文档。

---

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md
| 现象 | 原因 | 怎么办 |
| --- | --- | --- |
| 商品在动的过程中变形 | 运动幅度给太大 | 换成 `slow` / `subtle` 系的词，缩短时长 |
| 画面糊 | 原图分辨率不够 | 先用 [material-enhancement](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/material-enhancement/skill.md) 提清晰度 |
| 模特脸在动的时候崩 | 人脸是视频模型的重灾区 | 改用不露脸的景别，或改成商品特写 |
| 时长对不上 | 多数模型的时长是档位不是连续值 | 按模型支持的档位取，别硬凑 |
| 报错说没指定模型 | `DLAZY_VIDEO_MODEL` 没设 | 见「先配后端」 |

The image-to-video instructions omit disclosure that reference images are sent to the selected external backend.

Medium
Category
Output Handling
Confidence
87% confidence
Finding

The file instructs users to supply reference images through --images for video generation, with external backends such as fal and Replicate configured above. Unlike the backend catalog alone, this is an instruction to use user data, but it does not warn that potentially private images will be transmitted to the selected provider.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/providers.mjs (reported line 134)May include surrounding context.

js
model: () => env.GEN_MODEL_OPENAI || 'gpt-image-1',
  describe(req) {
    const ep = req.images?.length ? 'images/edits' : 'images/generations'
    return `POST https://api.openai.com/v1/${ep}  model=${openai.model()} size=${mapSize(req.size)} n=${req.batch}`
  },
  async run(req) {
    const key = env.OPENAI_API_KEY

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/providers.mjs (reported line 153)May include surrounding context.

js
: await readFile(p)
        fd.append('image[]', new Blob([buf], { type: mimeOf(p) }), path.basename(p))
      }
      r = await fetch('https://api.openai.com/v1/images/edits', {
        method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/providers.mjs (reported line 153)May include surrounding context.

js
: await readFile(p)
        fd.append('image[]', new Blob([buf], { type: mimeOf(p) }), path.basename(p))
      }
      r = await fetch('https://api.openai.com/v1/images/edits', {
        method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/providers.mjs (reported line 157)May include surrounding context.

js
method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {
      r = await fetch('https://api.openai.com/v1/images/generations', {
        method: 'POST',
        headers: { authorization: `Bearer ${key}`, 'content-type': 'application/json' },
        body: JSON.stringify({

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/providers.mjs (reported line 157)May include surrounding context.

js
method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {
      r = await fetch('https://api.openai.com/v1/images/generations', {
        method: 'POST',
        headers: { authorization: `Bearer ${key}`, 'content-type': 'application/json' },
        body: JSON.stringify({

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/providers.mjs (reported line 261)May include surrounding context.

js
model: (req) =>
    env.GEN_MODEL_REPLICATE ||
    (req?.images?.length ? 'black-forest-labs/flux-kontext-pro' : 'black-forest-labs/flux-dev'),
  describe(req) { return `POST https://api.replicate.com/v1/models/${replicate.model(req)}/predictions` },
  async run(req) {
    const input = { prompt: req.prompt, num_outputs: req.batch }
    if (req.images?.length) input.input_image = await asDataUri(req.images[0])

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/providers.mjs (reported line 266)May include surrounding context.

js
const input = { prompt: req.prompt, num_outputs: req.batch }
    if (req.images?.length) input.input_image = await asDataUri(req.images[0])
    const j = await postJson(
      `https://api.replicate.com/v1/models/${replicate.model(req)}/predictions`,
      { input },
      { authorization: `Bearer ${env.REPLICATE_API_TOKEN}`, prefer: 'wait' },
      req.timeoutMs,

Provider routing can select still-image generation backends for a skill advertised as image-to-video.

Medium
Category
Excessive Agency
Confidence
96% confidence
Finding

The manifest promises to turn a product image into a 3–5 second video, but automatic routing selects the first credentialed provider without checking video support. OpenAI exclusively calls image-editing/generation endpoints and returns image files (L131–L174), while Ark likewise calls images/generations and returns JPEGs (L290–L306); neither implementation uses req.video to generate video.

Content

No source excerpt is available for this finding.

The script supports multi-shot video production beyond the manifest's single-image, 3–5-second scope.

Low
Category
Excessive Agency
Confidence
94% confidence
Finding

The manifest describes turning one product image into a 3–5-second listing video. The storyboard branch instead reads an arbitrary list of shots, generates a separate video for each shot using its own image and duration, and concatenates the results into a longer production. This is an explicit additional workflow, not merely an implementation detail of single-image animation.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/lib/providers.mjs:104

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/video.mjs:69

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/gen.mjs:118

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/lib/providers.mjs:21