ClawHub
Back to skill

Security audit

视频内容理解官

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real paid video-analysis API wrapper, but users should review it because it uploads local media to a third-party service and keeps under-disclosed local cached results.

Install only if you are comfortable sending user-supplied video files or URLs to the We-Media cloud API for processing, storing the API key locally, and keeping generated results plus cached API responses on disk. Avoid using it with confidential or regulated media unless retention and privacy terms are acceptable.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)

Ae1

High
Category
analysis-evasion
Content
> 曼格云 skill ｜ 环节：做内容 ｜ 底层统一底座 `wm_core.py`
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Skill ships a __pycache__ directory that normal discovery skips

High
Category
Supply Chain
Content
Python may load .pyc from this directory even when decoy .py sources look clean (PEP 552 UNCHECKED_HASH).
Confidence
95% confidence
Finding
Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High
Category
Supply Chain
Content
Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.
Confidence
95% confidence
Finding
Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Skill ships Python bytecode (.pyc/.pyo) that normal analysis skips

High
Category
Supply Chain
Content
Bytecode is excluded from content analysis; a malicious .pyc can execute while source decoys remain clean.
Confidence
95% confidence
Finding
Skill ships Python bytecode (__pycache__/ or .pyc/.pyo). Discovery skips these paths, so malicious bytecode can score SAFE while decoy sources look clean.

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The skill is described as a video-understanding tool, but the manifest exposes a broad catalog of unrelated collection/search endpoints for WeChat articles, accounts, channel metadata, rankings, and search. This materially expands the agent’s reachable capability surface beyond the declared purpose, enabling unauthorized data gathering or function creep if the agent can invoke these endpoints without strict policy gating.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to use Python, access environment/configuration state, write a local config.json containing an API key, and make network requests, but it does not declare any explicit tool scope or allowed-tools boundary. This creates an over-privilege and transparency problem: an agent/runtime may grant broader capabilities than users expect, increasing the risk of unintended file access, secret handling, or outbound requests beyond the narrow video-analysis workflow.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
The manifest fields and operating instructions are all presented in Chinese, and the skill does not indicate that it is intentionally restricted to Chinese-speaking users or offer an alternative language. This can violate language/locale policy expectations when users are not given a choice or informed of the constraint.

Natural-Language Policy Violations

Medium
Confidence
90% confidence
Finding
Natural-language fields such as excluded_reason, name, note, and purpose are presented only in Chinese, which can effectively force a specific language/locale for users or downstream operators without opt-in. The file does not document that this skill is region-specific or offer an alternative language choice.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The module docstring, help text, error messages, and confirmation text are all presented only in Chinese, which imposes a language choice on users without opt-in. Under the policy, locale or language constraints should either offer user choice or be clearly documented as a justified regional limitation.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill uploads local files and sends request parameters to external services, but the execution path only enforces cost confirmation, not an explicit data-transfer/privacy confirmation at the moment sensitive content leaves the machine. In a video-analysis skill, uploaded videos may contain personal, confidential, or regulated data, so silent transmission to cloud storage/API endpoints creates a real privacy and data-governance risk.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Content
_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)
Confidence
93% confidence
Finding
This branch implicitly treats any non-URL string that resolves to a local path as a file to upload, which can cause unintentional transmission of local content if a user supplies a path where they expected local-only processing. The auto-upload behavior reduces transparency and increases the chance of accidental disclosure to remote storage and subsequent API processing.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Content
_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)
Confidence
93% confidence
Finding
This branch implicitly treats any non-URL string that resolves to a local path as a file to upload, which can cause unintentional transmission of local content if a user supplies a path where they expected local-only processing. The auto-upload behavior reduces transparency and increases the chance of accidental disclosure to remote storage and subsequent API processing.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Content
_v = params.get(_pk)
        if (isinstance(_v, str) and not _v.startswith(("http://", "https://", "file://"))
                and os.path.isfile(_v)):
            params[_pk] = wm.upload_file(_v)

    if pages > 1 and ep["method"].upper() == "POST":
        rows = wm.paginate(key, max_pages=pages, **params)
Confidence
93% confidence
Finding
This branch implicitly treats any non-URL string that resolves to a local path as a file to upload, which can cause unintentional transmission of local content if a user supplies a path where they expected local-only processing. The auto-upload behavior reduces transparency and increases the chance of accidental disclosure to remote storage and subsequent API processing.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
This Python file contains top-level documentation and runtime user prompts entirely in Chinese, including setup guidance and CLI help. Under the policy, forcing a specific language without offering user choice is a natural-language policy violation, and no opt-in or locale justification is provided here.

Unbounded Resource Access

Medium
Category
Excessive Agency
Content
import urllib.parse
import hashlib

EXIT_OK, EXIT_INPUT, EXIT_AUTH, EXIT_API, EXIT_NETWORK, EXIT_TIMEOUT = 0, 2, 3, 4, 6, 124

OFFICIAL = "https://api.we-media.cn"
ROOT = "https://api.we-media.cn"
Confidence
75% confidence
Finding
Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Context-Inappropriate Capability

Medium
Confidence
84% confidence
Finding
技能清单描述的是对视频做摘要、时间线、镜头/情绪和 OCR 分析；为实现这一目的，上传视频文件本身是合理的。但这里的 upload_file() 按扩展名接受音频、视频等任意本地文件并上传到远端临时存储，作为通用传输能力存在，范围比“理解视频内容”更宽，且该文件并未体现与视频专用场景绑定的限制。

Vague Triggers

Low
Confidence
87% confidence
Finding
The endpoint manifest defines available APIs but does not document invocation constraints, user-consent requirements, or allowed task scopes. In an agent setting, that ambiguity can let the model select costly or privacy-impacting endpoints without clear boundaries, increasing the chance of overreach and unintended data access.

Static analysis

No suspicious patterns detected.