ClawHub
Back to skill

Security audit

Video Editor

Security checks for vulnerabilities and agentic risk

Overview

This is a real local video-rendering skill, but it under-discloses sensitive local file handling that users should review before installing.

Install only if you are comfortable with a local video tool that reads media files and writes output videos. Do not run untrusted project JSON, keep credential-bearing .env files out of the skill and project directories, and avoid pointing outputs at existing files you need to preserve.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/render.py:25
Finding

Unnecessary Loading of Sensitive Environment Variables During Rendering

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/render.py:592
Finding

Project Asset Paths Are Not Confined to the Configured Base Directory

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/render.py (reported line 29)May include surrounding context.

python
def load_dotenv():
    script_dir = os.path.dirname(os.path.abspath(__file__))
    candidates = [
        os.path.join(script_dir, ".env"),
        os.path.join(script_dir, "..", ".env"),
    ]
    for path in candidates:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/render.py (reported line 30)May include surrounding context.

python
def load_dotenv():
    script_dir = os.path.dirname(os.path.abspath(__file__))
    candidates = [
        os.path.join(script_dir, ".env"),
        os.path.join(script_dir, "..", ".env"),
    ]
    for path in candidates:

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

macOS install FFmpeg

brew install ffmpeg

Ubuntu

sudo apt install ffmpeg

text

## Usage

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The markdown states that when global_font is omitted, the renderer automatically scans system fonts and infers a theme to choose fonts such as 'heiti' or 'songti'. This introduces an implicit locale/language choice in natural-language behavior without documenting user opt-in or offering a language selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script calls overwrite_output() when writing the result, which will replace any existing file at the target path. Although the operation is documented as producing an output file, there is no explicit warning in the help text or runtime messaging that an existing output file will be overwritten.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The concatenation branch also uses overwrite_output(), causing destructive replacement of any existing output file. The script prints success after completion, but provides no advance warning or confirmation that the output path may be overwritten.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The script automatically reads a local .env file and injects its contents into process environment variables, which is access to potentially sensitive credentials or configuration. Although the behavior is implemented clearly in code, there is no user-facing warning in the module docstring or CLI help that the renderer will read secrets/configuration from nearby .env files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language comments and candidate lists show the renderer prioritizes Chinese-specific fonts such as Heiti, Songti, and CJK fonts for multiple themes, including the default fallback path. This imposes a locale/language preference in generated text rendering without offering the user an explicit language or locale choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This file is a markdown file, so natural-language policy checks apply. The template uses Chinese-language directory names in asset paths while the surrounding instructions and subtitles are in English, but the description does not state any locale requirement or offer a language choice, which can create an implicit locale constraint.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The module docstring and CLI description present this as a local video rendering engine, but the code also reads key-value pairs from .env files and injects them into the process environment. Environment-variable loading is not an obvious requirement for rendering media from a project JSON, so this is an extra capability not justified by the stated purpose in the file's own documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The renderer performs a file write operation by creating the output video at the specified path. While it logs the destination immediately before writing, the top-level usage/docstring and argument help do not explicitly warn that running the script will generate or overwrite an output file on disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.