ClawHub
Back to skill

Security audit

Capcut Mate Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward CapCut automation wrapper, but users should understand that media project data is sent to the configured CapCut Mate API service.

Install this only if you trust the CapCut Mate server you configure. Keep the default localhost setup when possible, avoid sending private media to an untrusted remote endpoint, prefer HTTPS for non-local servers, and consider pinning dependencies before production use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly advertises cloud rendering and API-driven media processing, which implies that user media, draft content, and possibly metadata may be transmitted to another service. Because the documentation provides no warning, consent flow, or data-handling disclosure, users may unknowingly expose sensitive video/audio content or project data to a server outside the local agent runtime.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The configuration instructs users to connect the skill to an HTTP API endpoint without warning that project content will be sent to that service. Even though the sample uses localhost, the endpoint is configurable and could be redirected to a remote host; use of plain HTTP also risks interception if deployed off-host or across a network.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The dependency is specified with a caret range (^1.6.0), which allows new minor and patch releases to be installed over time. This weakens supply-chain reproducibility and can unexpectedly pull in a vulnerable or malicious release if the upstream package or registry is compromised.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json
"description": "Jianying/CapCut automation skill for OpenClaw.",
  "main": "index.js",
  "dependencies": {
    "axios": "^1.6.0"
  },
  "keywords": [
    "capcut",

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
81% confidence
Finding

The manifest uses an unpinned axios dependency, so the actual installed version cannot be verified against known advisories affecting axios. In an automation skill, HTTP client bugs can matter because they may enable SSRF, proxy bypass, credential leakage, or response tampering depending on how network requests are used elsewhere in the codebase.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
index.js:4