ClawHub
Back to skill

Security audit

Social Video Downloader

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its downloader has under-disclosed network and temporary-file safety weaknesses that merit review before installation.

Install only if you are comfortable with a local downloader making network requests from your machine and sending generated files back through the message tool. Prefer installing yt-dlp in an isolated pinned environment, run the downloader in a network-restricted sandbox if possible, and avoid use on sensitive hosts until the temporary-file handling and SSRF controls are tightened.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/download.py:66
Finding

SSRF Protection Is Vulnerable to DNS Rebinding and Unvalidated Redirects

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/download.py:88
Finding

Predictable Shared Temporary Filename Permits File Substitution

Content
View full analysis
`, send file to user via the message tool 4. On `ERROR:...`, report failure to user 5. After sending, delete the temp file with `rm ` ``` ### Technical Analysis The output name is based on the current time in whole seconds and is placed in the shared `/tmp` directory by default. Another local user can predict the filename and create a file or symbolic link at that location before `yt-dlp` writes the result. The script neither creates the destination exclusively nor validates the final object with `lstat`. After the subprocess exits, it only tests `os.path.exists`, which does not establish that the path is a newly created regular file, that it is not a symbolic link, or that it is owned by the expected user. The returned path is then intended to be sent to the user and deleted. The exact han ...[truncated 1599 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SETUP.md:6
Finding

Unpinned Dependency Is Installed into the System Python Environment

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SETUP.md (reported line 9)May include surrounding context.

bash
# Debian/Ubuntu/Kali
sudo apt install ffmpeg
pip install --break-system-packages yt-dlp

# macOS

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill instructs the agent to invoke a local Python script and perform network-backed media downloads, but the manifest declares no explicit tool scope or allowed-tools restrictions. This creates an authorization gap where the runtime may permit broader shell or network actions than intended, making misuse, overreach, or unsafe execution paths harder to constrain and audit.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download.py (reported line 113)May include surrounding context.

python
"--", url
    ]

    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)

    if result.returncode != 0:
        return None, f"Download failed: {result.stderr.strip()}"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download.py (reported line 141)May include surrounding context.

python
# Check metadata first
    print(f"Checking metadata for: {url}")
    meta_cmd = ["yt-dlp", "--no-playlist", "--print", "title", "--no-warnings", "--", url]
    meta_result = subprocess.run(meta_cmd, capture_output=True, text=True, timeout=30)

    if meta_result.returncode != 0 or not meta_result.stdout.strip():
        print(f"ERROR: Could not fetch video metadata. URL may be invalid or blocked.")

Static analysis

No suspicious patterns detected.