ClawHub
Back to skill

Security audit

Douyin Article

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it downloads or reads subtitles/audio from user-provided media links and produces local transcript files, with disclosed resource and network use.

Install only if you are comfortable with local media downloads, external command execution, and CPU-intensive transcription. Keep SKIP_CERT_CHECK unset unless you deliberately accept weaker TLS protection for troubleshooting, and treat fetched transcript text as data rather than instructions to the agent.

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
统一处理 subprocess 调用，避免重复代码。
    """
    try:
        result = subprocess.run(
            cmd_args, capture_output=True, text=True, timeout=timeout
        )
        output = (result.stdout or "") + (result.stderr or "")
Confidence
84% confidence
Finding
`run_cmd` is a generic subprocess wrapper that executes whatever argument vector its caller supplies, with no allowlist, path validation, or trust boundary enforcement. In a skill that processes external media URLs and likely orchestrates multiple tools, this helper becomes a high-risk sink if any upstream input can influence `cmd_args`, enabling arbitrary local command execution by chaining untrusted input into this function.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The code allows TLS certificate verification to be disabled for yt-dlp requests via the SKIP_CERT_CHECK environment variable, which weakens transport security and enables man-in-the-middle attacks if an attacker can influence the network path or environment. Although this appears intended as a compatibility workaround rather than malicious behavior, the lack of an explicit runtime warning or stronger gating makes accidental insecure operation more likely.

Unvalidated Output Injection

High
Category
Output Handling
Content
统一处理 subprocess 调用，避免重复代码。
    """
    try:
        result = subprocess.run(
            cmd_args, capture_output=True, text=True, timeout=timeout
        )
        output = (result.stdout or "") + (result.stderr or "")
Confidence
82% confidence
Finding
The generic `run_cmd` helper is a broad execution sink: if upstream code feeds it values derived from external tool output, URLs, filenames, or parsed metadata, untrusted data can directly influence process execution. In this media-transcription skill context, where many inputs originate from external platforms and tooling, that flexibility materially increases the chance of command execution abuse at call sites.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
## v4.1.1 — 2026-07-15

### Fixed
- **TLS 证书校验默认启用**（ClawHub SkillSpector Tool Parameter Abuse ×4 修复）：`fetch_bilibili.py` / `fetch_youtube.py` 中 4 处 `--no-check-certificates` 硬编码改为 `_cert_flags()` 函数控制，默认启用证书校验。仅当用户显式设置环境变量 `SKIP_CERT_CHECK=1` 时禁用（应对偶发的 B站证书过期问题），禁用为用户明确选择而非默认行为。
- **Description-Behavior Mismatch 修复**：description 的 Do NOT 表述从"视频下载、字幕提取"改为"纯视频文件下载（不转录）、纯字幕提取（不转录）"，明确区分"交付物"与"转录中间步骤"——管线确实会下载音频流作为转录中间产物，但不用于交付视频文件。
- **Description 声明 yt-dlp 通用平台支持**：description 明确列出 Vimeo/TikTok/Twitter 等通用平台，与代码 `ytdlp-generic` 路由一致，消除 scope-expansion 风险。
- **Vague Triggers 收窄**：触发词删除"视频翻译"（过于泛化，可能匹配普通翻译请求）和"批量转录视频"（与"批量转录视频链接"重复，保留后者更精确）。
Confidence
72% confidence
Finding
The changelog shows the skill supports disabling TLS certificate validation via `SKIP_CERT_CHECK=1`. Even though certificate checking is now enabled by default, retaining an easy bypass creates a downgrade path that can expose downloads and subtitle/transcript retrieval to man-in-the-middle tampering on hostile networks. In this skill’s context, fetched media, subtitles, or metadata could be altered, causing poisoned transcripts or malicious content ingestion.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
用于应对偶发的 B 站证书过期问题。禁用为用户显式选择，非默认行为。
    """
    if os.environ.get("SKIP_CERT_CHECK") == "1":
        return ["--no-check-certificates"]
    return []

SCRIPT_DIR = Path(__file__).resolve().parent
Confidence
91% confidence
Finding
The helper allows yt-dlp to run with '--no-check-certificates' when SKIP_CERT_CHECK=1 is set, disabling TLS certificate validation for remote downloads. That permits man-in-the-middle interception or tampering with downloaded media/metadata from network attackers, which is especially risky because this skill retrieves untrusted third-party content over the network.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
默认启用证书校验（安全）。仅当用户明确设置 SKIP_CERT_CHECK=1 时禁用。
    """
    if os.environ.get("SKIP_CERT_CHECK") == "1":
        return ["--no-check-certificates"]
    return []

SCRIPT_DIR = Path(__file__).resolve().parent
Confidence
91% confidence
Finding
Passing --no-check-certificates to yt-dlp disables server certificate validation, which permits interception or tampering of downloaded metadata and media by an active network attacker. In a skill that fetches remote content from public platforms, this materially increases exposure because the tool performs network downloads and processes the returned data automatically.

Static analysis

No suspicious patterns detected.