ClawHub
Back to skill

Security audit

视频爆款拆解与二创文案生成

Security checks for vulnerabilities and agentic risk

Overview

This video-analysis skill is mostly purpose-aligned, but it automatically installs network dependencies and can overwrite local output files, so it should be reviewed before installation.

Install only if you are comfortable with first-run network setup, large model downloads, and third-party Python packages executing under your user account. Use a new empty output directory for each run, avoid sensitive/internal URLs unless you intend them to be fetched, and prefer pinned or reviewed dependencies before production use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Automatic Installation of Unpinned Dependencies from a Third-Party Package Mirror

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-4; scripts/pipeline.py:54-63
Vulnerability Type: Software supply-chain risk caused by mutable dependency constraints, automatic installation, and lack of artifact verification
Risk Level: Medium

Vulnerable Code

text
# requirements.txt:1-4
faster-whisper>=1.0.0
easyocr>=1.7.0
imageio-ffmpeg>=0.4.9
yt-dlp>=2024.0.0
python
# scripts/pipeline.py:54-63
# Upgrade pip
print("[setup] 升级 pip ...")
run([str(venv_python), "-m", "pip", "install", "--upgrade", "pip",
     "-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])

# Install dependencies through the Tsinghua mirror
req_file = SKILL_DIR / "requirements.txt"
print("[setup] 安装依赖（清华源）...")
r = run([str(venv_python), "-m", "pip", "install", "-r", str(req_file),
         "-i", "https://pypi.tuna.tsinghua.edu.cn/simple"])

Technical Analysis

The first pipeline execution automatically upgrades pip and installs all runtime dependencies. Every dependency uses a lower-bound constraint rather than an exact version, so the effective code installed can change without any modification to the audited project.

The installation process also lacks a hash-locked requirements file or equivalent artifact integrity validation. Consequently, package selection and integrity depend on the current contents of the configured third-party mirror and on transitive dependency resolution at installation time.

This is a supply-chain weakness rather than evidence that the currently named packages are malicious. Exploitation requires compromise of an upstream package, a dependency, the configured mirror, or a subsequently published version accepted by the broad constraints.

Attack Path

  1. An attacker compromises a permitted package release, one of its transitive dependencies, or the configured package mirror.
  2. The attacker publishes or serves a malicious version satisfying the applicable >= constraint.
  3. A user launches the pipeline outs ...[truncated 698 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to a reviewed exact version.
  2. Generate a lock file that also fixes transitive dependency versions.
  3. Require cryptographic hashes for downloaded distributions, such as with pip --require-hashes.
  4. Prefer the canonical package index or an organization-controlled repository that synchronizes and verifies approved artifacts.
  5. Avoid automatic dependency installation during normal processing. Provide a separate, explicit setup command and obtain user approval before changing the environment.
  6. Pin the installer version instead of automatically upgrading pip to an uncontrolled latest release.
  7. Add automated vulnerability and provenance checks for both direct and transitive dependencies.
  8. Rebuild and review the lock file through a controlled update process.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/pipeline.py:161
Finding

Arbitrary Work Directory Can Cause Destructive File Overwrites and Deletions

Content
View full analysis

Vulnerability Details

File Location: scripts/pipeline.py:161-175, scripts/pipeline.py:322-323, and scripts/pipeline.py:375-376
Vulnerability Type: Unsafe output-directory handling and destructive fixed-name file operations
Risk Level: Medium

Vulnerable Code

python
# scripts/pipeline.py:161-175
def extract_audio(video, workdir, ffmpeg_bin):
    audio = workdir / "audio.wav"
    cmd = [ffmpeg_bin, "-y", "-i", str(video), "-vn", "-ac", "1", "-ar", "16000", str(audio)]
    r = run(cmd)
    if r.returncode != 0:
        print("[error] ffmpeg 抽音失败:")
        print(r.stderr[-800:] if r.stderr else "")
        sys.exit(1)
    return audio


def extract_frames(video, workdir, ffmpeg_bin, scene_threshold, fps):
    frames_dir = workdir / "frames"
    frames_dir.mkdir(exist_ok=True)
    for old in frames_dir.glob("frame_*.jpg"):
        old.unlink()
python
# scripts/pipeline.py:322-323
workdir = Path(args.workdir).resolve()
workdir.mkdir(parents=True, exist_ok=True)
python
# scripts/pipeline.py:375-376
output = workdir / "analysis.json"
output.write_text(json.dumps(result, ensure_ascii=False, indent=2), encoding="utf-8")

Technical Analysis

The caller can select any writable path as --workdir. The application resolves and creates that path but does not verify that it is a dedicated pipeline directory, that it is empty, or that existing files belong to an earlier run.

The pipeline then performs destructive operations using predictable names:

  • FFmpeg receives -y, unconditionally overwriting audio.wav.
  • Every frames/frame_*.jpg entry is deleted before extraction.
  • analysis.json is overwritten without confirmation.

The frame cleanup also follows normal filesystem path semantics. If a matching entry is a symbolic link, unlink() removes the link rather than its target; however, an attacker who can manipulate the work directory may still use directory-link or path-redirection conditions to affect where outp ...[truncated 1133 chars]

Remediation
View remediation

Remediation Suggestions

  1. Create a unique run-specific subdirectory inside a designated application output root.
  2. Reject non-empty output directories by default.
  3. Require an explicit --overwrite option before deleting or replacing existing artifacts.
  4. Before destructive operations, enumerate the affected files and request confirmation in interactive use.
  5. Validate that the resolved work directory is not a filesystem root, home directory, project root, or another protected location.
  6. Create files with exclusive semantics where practical and write analysis.json atomically through a temporary file followed by a controlled rename.
  7. Use a run manifest to delete only artifacts created by a previous pipeline run instead of deleting every filename matching a broad pattern.
  8. Check relevant path components for symbolic links before writing and enforce that resolved output paths remain within the approved run directory.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (20)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose is media analysis and copy generation, but the documented behavior also performs network downloads, runtime package installation, model fetching, and remote video retrieval. This mismatch is dangerous because users and orchestrators may authorize the skill for benign content analysis while it actually executes a software supply-chain and remote-content acquisition workflow with materially different risk.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

md
- `requirements.txt`：Python 依赖（faster-whisper、easyocr、imageio-ffmpeg）

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Automatically creating a venv and installing packages from an external mirror is an unjustified privileged capability for ordinary media analysis and materially increases supply-chain risk. The code fetches and executes unverified third-party packages at runtime, which could lead to arbitrary code execution if dependencies or the mirror are compromised.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/pipeline.py (reported line 76)May include surrounding context.

python
print("[setup] 环境就绪，重新启动 pipeline ...")
    print("=" * 50)
    # 用 venv 的 python 重启自己，带上原参数
    os.execv(str(venv_python), [str(venv_python)] + sys.argv)


def is_url(s):

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill explicitly instructs the agent to run shell commands, create a virtual environment, install dependencies, and write files, but it declares no tool scope or permission boundary. That makes the capability set implicit and harder to review, increasing the risk of unintended execution or over-broad invocation in environments that rely on manifest-level restrictions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger phrases are broad enough to match ordinary requests about analyzing or rewriting videos, which can cause the skill to auto-activate in situations where the user did not intend shell execution, downloading content, or setting up a runtime environment. In this skill, broad triggering is more dangerous because activation leads to filesystem writes and network activity, not just passive text assistance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises automatic link downloading and zero-config setup but does not prominently warn that it will contact external package indexes, model hosts, and remote video platforms, potentially transmitting user-supplied URLs and downloading untrusted content. This creates privacy, compliance, and supply-chain risk because users may provide sensitive links or assume local-only processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The example output specifies 'language': 'zh', which suggests a Chinese-only default or forced locale. The file does not state that language is auto-detected or user-selectable, so this can violate language/locale policy by imposing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file title and all required output structures are written as fixed Chinese templates, which effectively constrain the skill's interaction language. There is no indication that the user can opt into another language or that this is a documented region-specific limitation, so it presents a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes analyzing an input short video by extracting audio, frames, transcription, and OCR, but it does not mention fetching or downloading videos from remote platforms. Including yt-dlp adds a separate acquisition capability against external sources, which is not obviously required if the skill is only meant to process a user-provided video.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/pipeline.py (reported line 30)May include surrounding context.

python
def run(cmd):
    print("[run] " + " ".join(str(c) for c in cmd))
    return subprocess.run(cmd, capture_output=True, text=True, encoding="utf-8", errors="replace")


def ensure_env():

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script silently bootstraps a virtual environment, upgrades pip, and installs packages from the network despite being presented as a video-analysis skill. This is a substantial hidden capability because it executes package-management actions with code and dependency trust implications, creating supply-chain and system-modification risk outside the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script performs network package installation and modifies the local environment without explicit user consent or a clear warning about the resulting system and privacy impact. Even if intended for convenience, silent setup behavior can surprise users and expose them to dependency downloads, mirror trust issues, and resource consumption.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill claims to analyze an input video, but it also accepts arbitrary URLs and fetches remote content through yt-dlp. This expands the trust boundary and causes network access and third-party data transfer that a user may not expect from a local video-analysis skill, increasing privacy and SSRF-like exposure depending on runtime environment and supported URL schemes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script downloads user-supplied URLs via yt-dlp without explicit disclosure that content and metadata will be sent to external services. In the context of a media-analysis skill, this hidden network behavior raises privacy concerns and can expose internal or sensitive URLs if the runtime has broader network reach than the user expects.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

Using a lower-bounded but unpinned dependency for faster-whisper allows future versions to be installed without review, creating supply-chain risk and reducing build reproducibility. A newly released compromised or incompatible version could introduce malicious code or break security assumptions at install or runtime.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
faster-whisper>=1.0.0
easyocr>=1.7.0
imageio-ffmpeg>=0.4.9
yt-dlp>=2024.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The unpinned easyocr dependency permits installation of any newer version satisfying the constraint, which exposes the skill to unexpected upstream changes and supply-chain compromise risk. Because this skill processes untrusted media inputs, dependency trust and reproducibility matter more than in a static offline tool.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
faster-whisper>=1.0.0
easyocr>=1.7.0
imageio-ffmpeg>=0.4.9
yt-dlp>=2024.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

imageio-ffmpeg is unpinned, so deployments may pull different versions over time, increasing exposure to newly introduced vulnerabilities or malicious upstream changes. Since ffmpeg-related tooling often handles complex untrusted media formats, version drift can materially increase risk.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
faster-whisper>=1.0.0
easyocr>=1.7.0
imageio-ffmpeg>=0.4.9
yt-dlp>=2024.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

An unpinned yt-dlp dependency is a meaningful supply-chain and exposure risk because the package interacts with remote sites and complex extractors, and its behavior can change significantly across releases. In a skill designed to fetch and analyze internet-hosted videos, uncontrolled upgrades can introduce known vulnerabilities or unsafe execution paths into a network-facing workflow.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text
faster-whisper>=1.0.0
easyocr>=1.7.0
imageio-ffmpeg>=0.4.9
yt-dlp>=2024.0.0

Unverifiable Dependency: yt-dlp has 16 known advisory(ies) (CVE-2023-46121 (yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection); GHSA-3v33-3wmw-3785 (yt-dlp has dependency on potentially malicious third-party code in Douyu extract); CVE-2023-40581 ( yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
97% confidence
Finding

yt-dlp has multiple known advisories, and because the dependency is not pinned, it is impossible to determine whether deployments will install an affected version. This is more dangerous in this skill's context because yt-dlp is central to acquiring remote media, making a vulnerable release directly reachable through normal use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.