ClawHub
Back to skill

Security audit

guaikei文案改写

Security checks for vulnerabilities and agentic risk

Overview

Review before installing: this skill can upload an older cached video instead of the requested video, and its network restrictions are inaccurately described.

Use non-sensitive videos until the cache-collision issue is fixed and the actual upload destinations are disclosed. Expect paid cloud processing and local cached copies. Confirm the provider's deletion and no-training promises before sending confidential recordings.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding

Token validation can be a legitimate supporting implementation detail, and this utility's lack of transcription logic alone is not a mismatch. However, the code adds an undisclosed private-token gate and promotional acquisition messages unrelated to the stated Qianwen-based video-processing purpose. This chunk does not make network requests, verify token authenticity, or itself demonstrate that the entire skill stops running.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 99)May include surrounding context.

md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file`
5. 无自定义 prompt 时，默认完整转录视频全部文字

| 用户自然语言指令                                         | 自动生成命令                                                                                                |
| -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 视频提取 https://example.com/video.mp4 中的文字          | `node scripts/video2text/index.js --file "https://example.com/video.mp4"`                                   |
| 把本地 /path/to/your/video.mp4 改成小红书风格的文案      | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"`       |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · guaikei-cross-platform-video-to-text/README.md (reported line 99)May include surrounding context.

md
4. 同时传入文件路径与任务ID，优先执行 `--id`，忽略 `--file`
5. 无自定义 prompt 时，默认完整转录视频全部文字

| 用户自然语言指令                                         | 自动生成命令                                                                                                |
| -------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 视频提取 https://example.com/video.mp4 中的文字          | `node scripts/video2text/index.js --file "https://example.com/video.mp4"`                                   |
| 把本地 /path/to/your/video.mp4 改成小红书风格的文案      | `node scripts/video2text/index.js --file "/path/to/your/video.mp4" --prompt "改写成小红书风格的文案"`       |

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md
当用户用自然语言下达指令时，按以下映射生成命令，保证识别与执行一致：

| 用户自然语言指令                                     | 生成的命令                                                                                                  |
| ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 提取 https://example.com/video.mp4 里的文字          | `node scripts/video2text/index.js --file "https://example.com/video.mp4"`                                   |
| 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · guaikei-cross-platform-video-to-text/SKILL.md (reported line 132)May include surrounding context.

md
当用户用自然语言下达指令时，按以下映射生成命令，保证识别与执行一致：

| 用户自然语言指令                                     | 生成的命令                                                                                                  |
| ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------- |
| 提取 https://example.com/video.mp4 里的文字          | `node scripts/video2text/index.js --file "https://example.com/video.mp4"`                                   |
| 总结这个视频的核心观点 https://example.com/video.mp4 | `node scripts/video2text/index.js --file "https://example.com/video.mp4" --prompt "总结这个视频的核心观点"` |

Failed downloads silently delete the destination file, including an existing file being resumed.

Medium
Category
Output Handling
Confidence
97% confidence
Finding

The default removeOnFail setting causes __removeFile() to unlink the destination without distinguishing a newly created download from a pre-existing file opened through resumeFromFile() or resumeIfFileExists. A failed or timed-out transfer after that file is opened can therefore delete existing data; an attacker-controlled video endpoint could deliberately trigger such failures. Cleaning up incomplete video downloads is legitimate, but deleting a resumed file without explicit consent creates a data-loss vulnerability; the download error is reported, so the failure itself is not silent.

Content

No source excerpt is available for this finding.

Stopping or failing a download deletes the destination file by default without disclosing the deletion.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

The stop workflow unlinks the destination file, and removeOnStop defaults to true (L0044); failure cleanup also deletes it when removeOnFail is enabled (L1047–L1058), which is the default. No confirmation, explanatory comment, or user-facing message discloses this destructive behavior; generic stop/error events do not explain that the file is deleted. This can also affect an existing file supplied to resumeFromFile.

Content

No source excerpt is available for this finding.