ClawHub
Back to skill

Security audit

Ai video for free

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed AI video pipeline, but it can automatically send generated content to Telegram and external services from broad triggers without a clear per-run confirmation step.

Install only if you expect every run to use HuggingFace, ElevenLabs, ffmpeg, and Telegram. Before running it, confirm the Telegram chat destination, avoid confidential topics or scripts, and validate or restrict project_name to a simple safe identifier.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:431
Finding

User-Controlled Path Traversal and File Overwrite

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

Inference API أو Wan2.6 Space
النموذج: Wan-AI/Wan2.6-T2V-14B (الأفضل جودةً)
البديل: Wan-AI/Wan2.1-T2V-14B (أسرع)

📋 للتفاصيل الكاملة لـ Wan2.6 ومعاملاته راجع: references/wan2-api.md

كود توليد فيديو مشهد واحد

python
import requests, time, os

def generate_scene_video(scene, project_dir, hf_token):
    """يولّد فيديو مشهد واحد باستخدام Wan2.6"""
    
    # بناء الـ prompt مع الأسلوب الموحّد
    prompt = f"""
    {scene['visual_description']},
    cinematic quality, 9:16 vertical format, ultra-realistic,
    smooth motion, professional lighting, no text, no watermark,
    {', '.join(scene['visual_keywords'])}
    """
    
    # إرسال الطلب لـ HuggingFace
    headers = {
        "Authorization": f"Bearer {hf_token}",
        "Content-Type": "application/json"
    }
    
    payload = {
        "inputs": prompt.strip(),

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill description omits a clear disclosure that prompts, scripts, voice text, generated media, and message metadata are sent to third-party services and then published to Telegram. This undermines informed consent and can lead to accidental disclosure of sensitive or proprietary user content through automatic outbound transfers.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger list contains very broad Arabic phrases such as 'اعمل فيديو' and 'اعمل شورت', which can cause the skill to activate for generic content-generation requests that a user may not expect to route through a pipeline that calls multiple external services. In this skill, unintended activation is more dangerous because execution can transmit user content and generated media to HuggingFace, ElevenLabs, and Telegram automatically.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This request sends scene visual descriptions and related content to the HuggingFace inference endpoint, creating an external data flow. While expected for the feature, it is still a security/privacy risk if user-provided topics contain confidential information, because the transfer occurs automatically as part of the pipeline.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

md
model_id = "Wan-AI/Wan2.6-T2V-14B"
    api_url = f"https://api-inference.huggingface.co/models/{model_id}"
    
    response = requests.post(api_url, headers=headers, json=payload, timeout=300)
    
    if response.status_code == 200:
        # حفظ الفيديو

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The ElevenLabs endpoint definition reflects a built-in external integration for speech synthesis, which means the skill is designed to transmit user-derived content off-platform. In context, this is not inherently malicious, but it increases the privacy and compliance risk profile of the skill because the transmission is central to normal operation.

Content

Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.

md
def generate_voiceover(scene, project_dir, elevenlabs_key, voice_id):
    """يولّد الفويس أوفر لمشهد واحد بـ ElevenLabs"""
    
    url = f"https://api.elevenlabs.io/v1/text-to-speech/{voice_id}"
    
    headers = {
        "xi-api-key": elevenlabs_key,

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This request sends the generated voiceover text to ElevenLabs for TTS, exposing script content to an external provider. If the prompt or generated script contains personal, confidential, or regulated information, that data leaves the local environment without additional safeguards.

Content

Scanner excerpt · SKILL.md (reported line 286)May include surrounding context.

md
}
    }
    
    response = requests.post(url, headers=headers, json=payload, timeout=60)
    
    if response.status_code == 200:
        output_path = os.path.join(project_dir, f"vo_{scene['scene_number']:02d}.mp3")

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The Telegram send operation transmits the final video and a caption derived from the script to a configured chat ID, which can publicly or privately distribute content outside the agent environment. This is particularly risky because the destination is preconfigured through environment variables, so accidental activation can result in unintended publication or disclosure.

Content

Scanner excerpt · SKILL.md (reported line 407)May include surrounding context.

md
caption += f"\n\n⏱️ المدة: {script['total_duration']}"
    caption += "\n\n🤖 _تم الإنتاج بالكامل بالذكاء الاصطناعي_"
    
    url = f"https://api.telegram.org/bot{bot_token}/sendVideo"
    
    with open(video_path, 'rb') as video_file:
        response = requests.post(url, data={

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example sends arbitrary text and an ElevenLabs API key to a third-party service without any warning about external data transfer, consent, or handling of sensitive content. In the context of this skill, users may provide scripts, prompts, or private material for voice generation, so documenting this flow without privacy safeguards can lead to unintentional disclosure of user data.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This code performs an outbound request to ElevenLabs and includes both user-provided text and an API credential in the request. External transmission is expected for TTS functionality, but it is still security-relevant because the skill pipeline may process user-generated or confidential content and forward it to a third party without any disclosure, minimization, or policy checks.

Content

Scanner excerpt · references/elevenlabs-arabic.md (reported line 30)May include surrounding context.

md
settings = emotion_map.get(emotion, emotion_map["محايد"])
    
    response = requests.post(
        f"https://api.elevenlabs.io/v1/text-to-speech/{voice_id}",
        headers={
            "xi-api-key": api_key,

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/elevenlabs-arabic.md (reported line 31)May include surrounding context.

md
settings = emotion_map.get(emotion, emotion_map["محايد"])
    
    response = requests.post(
        f"https://api.elevenlabs.io/v1/text-to-speech/{voice_id}",
        headers={
            "xi-api-key": api_key,
            "Content-Type": "application/json"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file includes multiple ffmpeg commands using the -y flag, which forces overwriting output files without prompting. The recipe presents these commands as ready-to-run examples but does not warn users that files like merged_01.mp4 may be silently replaced, which is a user-data integrity concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The file presents its instructional content and headings in Arabic while not indicating that Arabic is required or offering an alternative language option. Per the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/wan2-api.md (reported line 36)May include surrounding context.

} }

response = requests.post(HF_API_URL, headers=headers, json=payload, timeout=300)

response.content = bytes (MP4 file)

text

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The instructions use echo ... >> concat_list.txt, which appends to the file on every run. Without a warning, users may unknowingly accumulate duplicate entries or alter an existing list file, affecting output correctness and modifying local data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file includes example code that posts user prompts to Hugging Face Inference API and Gradio-hosted services, which transmits user-provided content to a third-party network endpoint. The surrounding documentation does not include any warning about privacy, external processing, or handling of sensitive prompt data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.