ClawHub
Back to skill

Security audit

TierList Video Maker

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently turns public TierVibe posts into videos, with disclosed risks around runtime dependency installs and online TTS.

Install and run this in a virtual environment, use only public TierVibe posts you are comfortable sending through online TTS, and review the generated narration/card manifest before creating the final video.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The script automatically invokes pip at runtime to install Pillow if it is missing, which executes an external package manager operation inside the agent context. Even though the package name is fixed, this still expands the attack surface to package-index compromise, dependency confusion via custom pip configuration, or unsafe execution in restricted environments, and it violates the principle of keeping dependencies immutable at runtime.

Content

Scanner excerpt · scripts/fetch_tierlist.py (reported line 120)May include surrounding context.

python
import subprocess
        print("Installing Pillow (needed to render text cards)...", file=sys.stderr)
        try:
            subprocess.check_call([sys.executable, "-m", "pip", "install", "Pillow", "-q"])
        except subprocess.CalledProcessError as e:
            print(f"  [ERROR] cannot render text cards without Pillow ({e}). On "
                  "Debian/Ubuntu or Homebrew Python this is usually PEP 668 — try "

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
96% confidence
Finding

The script automatically invokes pip at runtime via subprocess to install missing packages. This expands the skill's capabilities from local video composition to arbitrary package retrieval and code execution from external package sources, which is risky in an agent environment because dependency resolution and package installation can execute untrusted installer code and modify the host environment.

Content

Scanner excerpt · scripts/generate_video.py (reported line 49)May include surrounding context.

python
if missing:
        import subprocess
        print(f"Installing: {', '.join(missing)}...", file=sys.stderr)
        subprocess.check_call([sys.executable, "-m", "pip", "install", *missing, "-q"])


ensure_deps()

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
93% confidence
Finding

The script executes a package installation command at runtime in the current Python environment via pip. Even though it does not use a shell and the package name is hardcoded, this still causes unreviewed code to be fetched and installed from external package sources during execution, expanding the trust boundary and creating supply-chain and environment-modification risk.

Content

Scanner excerpt · scripts/tts_narration.py (reported line 35)May include surrounding context.

python
print("Installing edge-tts...", file=sys.stderr)
        import subprocess
        try:
            subprocess.check_call([sys.executable, "-m", "pip", "install", "edge-tts", "-q"])
        except subprocess.CalledProcessError as e:
            raise SystemExit(
                f"Failed to install edge-tts ({e}). On Debian/Ubuntu or Homebrew "

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill clearly instructs the agent to read and write local files, access the network, and execute shell commands, but it does not declare any permissions or capability boundaries. That mismatch is a real security issue because users and hosting platforms cannot accurately assess or constrain what the skill is allowed to do, increasing the risk of over-privileged execution, unexpected network access, or command execution if the skill or its dependencies are abused.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Auto-installing Python packages during execution introduces package-management behavior that is unnecessary for the core task and dangerous in sandboxed or shared systems. In this skill context, the agent is expected to process user-provided tier-list content, so silently reaching out to install dependencies increases the attack surface, can bypass environment controls, and may execute code from package installation hooks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The helper intentionally installs edge-tts into the active interpreter on first use, which modifies the host environment beyond simple narration generation. In an agent-skill context, runtime dependency installation is risky because it introduces network fetches, package execution during install, and persistent changes on the machine without explicit operator approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The narration text is sent to the external edge-tts service for synthesis, which means potentially sensitive user-provided content leaves the local environment. In this skill, narration is generated from tier-list content and user-written script text, so undisclosed external transmission creates a privacy and data-handling risk, especially if users assume processing is local.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.