ClawHub
Back to skill

Security audit

TierList Video Maker

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently turns public TierVibe posts into videos, with disclosed risks around runtime dependency installs and online TTS.

Install and run this in a virtual environment, use only public TierVibe posts you are comfortable sending through online TTS, and review the generated narration/card manifest before creating the final video.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
import subprocess
        print("Installing Pillow (needed to render text cards)...", file=sys.stderr)
        try:
            subprocess.check_call([sys.executable, "-m", "pip", "install", "Pillow", "-q"])
        except subprocess.CalledProcessError as e:
            print(f"  [ERROR] cannot render text cards without Pillow ({e}). On "
                  "Debian/Ubuntu or Homebrew Python this is usually PEP 668 — try "
Confidence
95% confidence
Finding
The script automatically invokes pip at runtime to install Pillow if it is missing, which executes an external package manager operation inside the agent context. Even though the package name is fixed, this still expands the attack surface to package-index compromise, dependency confusion via custom pip configuration, or unsafe execution in restricted environments, and it violates the principle of keeping dependencies immutable at runtime.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
if missing:
        import subprocess
        print(f"Installing: {', '.join(missing)}...", file=sys.stderr)
        subprocess.check_call([sys.executable, "-m", "pip", "install", *missing, "-q"])


ensure_deps()
Confidence
96% confidence
Finding
The script automatically invokes pip at runtime via subprocess to install missing packages. This expands the skill's capabilities from local video composition to arbitrary package retrieval and code execution from external package sources, which is risky in an agent environment because dependency resolution and package installation can execute untrusted installer code and modify the host environment.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
print("Installing edge-tts...", file=sys.stderr)
        import subprocess
        try:
            subprocess.check_call([sys.executable, "-m", "pip", "install", "edge-tts", "-q"])
        except subprocess.CalledProcessError as e:
            raise SystemExit(
                f"Failed to install edge-tts ({e}). On Debian/Ubuntu or Homebrew "
Confidence
93% confidence
Finding
The script executes a package installation command at runtime in the current Python environment via pip. Even though it does not use a shell and the package name is hardcoded, this still causes unreviewed code to be fetched and installed from external package sources during execution, expanding the trust boundary and creating supply-chain and environment-modification risk.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill clearly instructs the agent to read and write local files, access the network, and execute shell commands, but it does not declare any permissions or capability boundaries. That mismatch is a real security issue because users and hosting platforms cannot accurately assess or constrain what the skill is allowed to do, increasing the risk of over-privileged execution, unexpected network access, or command execution if the skill or its dependencies are abused.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
Auto-installing Python packages during execution introduces package-management behavior that is unnecessary for the core task and dangerous in sandboxed or shared systems. In this skill context, the agent is expected to process user-provided tier-list content, so silently reaching out to install dependencies increases the attack surface, can bypass environment controls, and may execute code from package installation hooks.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The helper intentionally installs edge-tts into the active interpreter on first use, which modifies the host environment beyond simple narration generation. In an agent-skill context, runtime dependency installation is risky because it introduces network fetches, package execution during install, and persistent changes on the machine without explicit operator approval.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The narration text is sent to the external edge-tts service for synthesis, which means potentially sensitive user-provided content leaves the local environment. In this skill, narration is generated from tier-list content and user-written script text, so undisclosed external transmission creates a privacy and data-handling risk, especially if users assume processing is local.

Static analysis

No suspicious patterns detected.