ClawHub
Back to skill

Security audit

douyin-article

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed batch media transcription pipeline that uses expected local tools and network access to create transcript files.

Install only if you are comfortable with a local workflow that downloads media/subtitles, runs external tools, and stores transcripts under outputs/. Do not set SKIP_CERT_CHECK=1 except for a deliberate one-off troubleshooting run on a trusted network, and review the legality/terms of downloading content from each platform.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
统一处理 subprocess 调用，避免重复代码。
    """
    try:
        result = subprocess.run(
            cmd_args, capture_output=True, text=True, timeout=timeout
        )
        output = (result.stdout or "") + (result.stderr or "")
Confidence
83% confidence
Finding
result = subprocess.run( cmd_args, capture_output=True, text=True, timeout=timeout )

Unvalidated Output Injection

High
Category
Output Handling
Content
统一处理 subprocess 调用，避免重复代码。
    """
    try:
        result = subprocess.run(
            cmd_args, capture_output=True, text=True, timeout=timeout
        )
        output = (result.stdout or "") + (result.stderr or "")
Confidence
86% confidence
Finding
subprocess.run( cmd_args, capture_output

Tool Parameter Abuse

High
Category
Tool Misuse
Content
用于应对偶发的 B 站证书过期问题。禁用为用户显式选择，非默认行为。
    """
    if os.environ.get("SKIP_CERT_CHECK") == "1":
        return ["--no-check-certificates"]
    return []

SCRIPT_DIR = Path(__file__).resolve().parent
Confidence
89% confidence
Finding
--no-check

Tool Parameter Abuse

High
Category
Tool Misuse
Content
默认启用证书校验（安全）。仅当用户明确设置 SKIP_CERT_CHECK=1 时禁用。
    """
    if os.environ.get("SKIP_CERT_CHECK") == "1":
        return ["--no-check-certificates"]
    return []

SCRIPT_DIR = Path(__file__).resolve().parent
Confidence
92% confidence
Finding
--no-check

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.