ClawHub
Back to skill

Security audit

aaaa

Security checks for vulnerabilities and agentic risk

Overview

This skill has some rough scoping and execution choices, but its file writes, Markdown processing, and screenshot generation are disclosed and fit the subtitle-to-notes workflow.

Install only if you are comfortable with the skill creating Markdown/output files and running a bundled Python script that may invoke ffmpeg on a local MP4 in the current directory. Use it in a clean folder containing only the intended generated Markdown and video file to avoid processing the wrong file.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose is converting SRT subtitles to Markdown notes, but the behavior described by analysis includes scanning local files, invoking screenshot extraction, generating attachments, and modifying Markdown. This description-behavior mismatch is dangerous because it can conceal broader filesystem access and subprocess execution behind an innocuous-looking skill description, reducing user and reviewer scrutiny.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The implementation materially diverges from the declared skill purpose: instead of converting SRT to Markdown, it scans existing Markdown and optionally processes local MP4 files with ffmpeg. This kind of capability mismatch is dangerous because users and reviewers may authorize the skill under false assumptions, allowing unintended file processing and external tool execution in their workspace.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill text instructs writing files to the project root and executing a Python script, which implies file and shell capabilities, yet it declares no explicit tool scope or permissions. This creates an unsafe mismatch where an agent may perform filesystem changes and code execution without transparent authorization boundaries, increasing the risk of unintended or abusive actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction 使用中文书写 forces a specific language choice in the skill behavior. The file does not provide user opt-in, alternatives, or a documented reason that would justify a Chinese-only constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill mandates saving output to the project root, which modifies user files without warning or consent. Unannounced writes can overwrite existing content, create persistence in a repository, or alter a workspace in ways the user did not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs running a local Python script without any warning that code will be executed. Silent subprocess execution is risky because the script may perform arbitrary actions on the host, access local data, invoke external binaries such as ffmpeg, or make further modifications beyond the stated task.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This file contains natural-language comments, docstrings, log messages, and errors in Chinese only, such as the screenshot-related documentation and runtime messages. That creates a language/locale restriction for operators or users without offering a choice or documenting a justified region-specific constraint, which fits the policy-violation category.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script introduces ffmpeg-based video processing that is not justified by the stated SRT-to-Markdown purpose, expanding the attack surface through external binary execution and parsing of potentially untrusted media files. Even without shell injection, invoking complex media tooling on arbitrary local inputs can expose the environment to parser bugs, unexpected resource consumption, or unauthorized processing of unrelated files.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/screenshot.py (reported line 59)May include surrounding context.

python
"-y",
    ]
    logging.info("生成截图：time=%s, file=%s", timestamp, output_path)
    subprocess.run(cmd, check=False, capture_output=True)
    return output_path

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code and messaging claim SRT handling, but the logic actually searches for .md files and rewrites Screenshot markers, which is a deceptive behavior mismatch. In agent skill ecosystems, this is security-relevant because hidden or mislabeled file-processing behavior can cause unintended modification of user content and undermine informed consent.

Content

No source excerpt is available for this finding.