ClawHub
Back to skill

Security audit

carrusel-noticiero

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Spanish-language workflow for creating Instagram news carousel assets, with local rendering and optional external media generation.

Before installing, confirm you are comfortable with the skill using Chromium locally, installing puppeteer-core, calling external media services that may consume credits, and using configured API tokens for Apify/Gemini/Higgsfield when needed. Expect manual assembly for the animated cover on this server despite one output section mentioning a finished MP4.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
La descripción declara una skill de alto nivel que transforma una noticia en un carrusel noticiero completo con narrativa específica, tematización, portada animada y assets listos para edición. El código mostrado únicamente implementa la parte de renderizado/exportación: recibe una ruta a un HTML local, lanza Chromium headless, localiza nodos .slide y los guarda como PNG. No hay ninguna lógica de ingestión o análisis de noticias, generación de copy, armado de 8 slides, selección de tema, creación de video/animación, ni entrega de titular transparente más allá del soporte genérico de transparencia al capturar una slide. Por tanto, el comportamiento real representa solo un subcomponente de render, no la funcionalidad principal declarada, y además contradice la nota de que no debe usarse para 'solo renderizar un guion existente'.

Hidden Instructions

High
Category
Prompt Injection
Content
</head>
<body>

<!-- S2 — QUÉ PASÓ -->
<div class="slide s2">
  <div class="tape tape-1"></div>
  <div class="sticker sticker-1">‹⚡›</div>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<div class="handle">@tuhandle</div>
</div>

<!-- S4 — EL DATO QUE ASUSTA -->
<div class="slide s4">
  <div class="tape tape-1"></div>
  <div class="tape tape-2"></div>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill references sensitive execution capabilities and secrets handling (`APIFY_TOKEN`, `GEMINI_API_KEY`, `CHROME_PATH`) plus local command execution, but does not declare an explicit tool or permission scope. That creates an overbroad trust boundary where an agent may access environment variables or execute commands beyond what a reviewer or runtime policy expects.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
At L030, the skill says it outputs `slide-01-ANIMADO.mp4` as a finished ffmpeg composition. But L017 and L101 state that ffmpeg composition does not run on this server and that the deliverable is only `cover_anim_raw.mp4` plus `title-overlay.png` for manual assembly in CapCut or Edits. This is an active contradiction in the skill's own documentation about what it actually produces.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The instruction requires all copy to be in 'español neutro', which is a language/locale constraint imposed by the skill rather than offered as a user choice. The file does not indicate that users can opt into another language or locale, so this is a natural-language policy issue.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
Line L02 sets the document language to Spanish via `lang="es"`. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or documented justification can be a locale policy issue.

Natural-Language Policy Violations

Low
Confidence
96% confidence
Finding
The document declares `lang="es"`, and the visible UI text is also entirely in Spanish, which indicates the skill is fixed to a specific language. Under the policy, locale restrictions should either offer user opt-in/choice or be clearly documented as a justified region-specific constraint.

Natural-Language Policy Violations

Low
Confidence
91% confidence
Finding
The file’s natural-language comments, usage instructions, and user-facing messages are written only in Spanish, with no indication that the skill is intentionally region-specific or that another language is available. Under the policy, forcing a specific language without opt-in or documented justification is a natural-language policy concern.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"export": "node export.js"
  },
  "dependencies": {
    "puppeteer-core": "^24.42.0"
  }
}
Confidence
95% confidence
Finding
The dependency uses a caret range (^24.42.0), which allows installation of newer compatible versions rather than a single fixed release. This can introduce supply-chain risk and reduce build reproducibility, because different environments or future installs may resolve to different package versions with changed behavior or newly introduced malicious or vulnerable code.

Vague Triggers

Low
Confidence
88% confidence
Finding
Line L29 says to invoke the skill by saying "usa el tema <nombre>", but it does not define whether that is the only accepted trigger, where it must be said, or what happens if similar phrasing is used. This ambiguity could cause unintended activation or inconsistent invocation behavior in natural-language contexts.

Natural-Language Policy Violations

Low
Confidence
94% confidence
Finding
This markdown file includes a full HTML template with `<html lang="es">`, which forces Spanish locale behavior. Under the policy rules, fixed language selection is a natural-language policy concern unless the skill offers user opt-in or clearly justifies that the skill is region-specific.

Static analysis

No suspicious patterns detected.