ClawHub
Back to skill

Security audit

carrusel-noticiero

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Spanish-language workflow for creating Instagram news carousel assets, with local rendering and optional external media generation.

Before installing, confirm you are comfortable with the skill using Chromium locally, installing puppeteer-core, calling external media services that may consume credits, and using configured API tokens for Apify/Gemini/Higgsfield when needed. Expect manual assembly for the animated cover on this server despite one output section mentioning a finished MP4.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

La descripción declara una skill de alto nivel que transforma una noticia en un carrusel noticiero completo con narrativa específica, tematización, portada animada y assets listos para edición. El código mostrado únicamente implementa la parte de renderizado/exportación: recibe una ruta a un HTML local, lanza Chromium headless, localiza nodos .slide y los guarda como PNG. No hay ninguna lógica de ingestión o análisis de noticias, generación de copy, armado de 8 slides, selección de tema, creación de video/animación, ni entrega de titular transparente más allá del soporte genérico de transparencia al capturar una slide. Por tanto, el comportamiento real representa solo un subcomponente de render, no la funcionalidad principal declarada, y además contradice la nota de que no debe usarse para 'solo renderizar un guion existente'.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · themes/scrapbook.md (reported line 153)May include surrounding context.

md
</head>
<body>

<!-- S2 — QUÉ PASÓ -->
<div class="slide s2">
  <div class="tape tape-1"></div>
  <div class="sticker sticker-1">‹⚡›</div>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · themes/scrapbook.md (reported line 186)May include surrounding context.

md
<div class="handle">@tuhandle</div>
</div>

<!-- S4 — EL DATO QUE ASUSTA -->
<div class="slide s4">
  <div class="tape tape-1"></div>
  <div class="tape tape-2"></div>

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill references sensitive execution capabilities and secrets handling (APIFY_TOKEN, GEMINI_API_KEY, CHROME_PATH) plus local command execution, but does not declare an explicit tool or permission scope. That creates an overbroad trust boundary where an agent may access environment variables or execute commands beyond what a reviewer or runtime policy expects.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

At L030, the skill says it outputs slide-01-ANIMADO.mp4 as a finished ffmpeg composition. But L017 and L101 state that ffmpeg composition does not run on this server and that the deliverable is only cover_anim_raw.mp4 plus title-overlay.png for manual assembly in CapCut or Edits. This is an active contradiction in the skill's own documentation about what it actually produces.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The instruction requires all copy to be in 'español neutro', which is a language/locale constraint imposed by the skill rather than offered as a user choice. The file does not indicate that users can opt into another language or locale, so this is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

Line L02 sets the document language to Spanish via lang="es". Under the policy rule for natural-language violations, forcing a specific language without user opt-in or documented justification can be a locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document declares lang="es", and the visible UI text is also entirely in Spanish, which indicates the skill is fixed to a specific language. Under the policy, locale restrictions should either offer user opt-in/choice or be clearly documented as a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file’s natural-language comments, usage instructions, and user-facing messages are written only in Spanish, with no indication that the skill is intentionally region-specific or that another language is available. Under the policy, forcing a specific language without opt-in or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency uses a caret range (^24.42.0), which allows installation of newer compatible versions rather than a single fixed release. This can introduce supply-chain risk and reduce build reproducibility, because different environments or future installs may resolve to different package versions with changed behavior or newly introduced malicious or vulnerable code.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json
"export": "node export.js"
  },
  "dependencies": {
    "puppeteer-core": "^24.42.0"
  }
}

Vague Triggers

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Line L29 says to invoke the skill by saying "usa el tema ", but it does not define whether that is the only accepted trigger, where it must be said, or what happens if similar phrasing is used. This ambiguity could cause unintended activation or inconsistent invocation behavior in natural-language contexts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file includes a full HTML template with <html lang="es">, which forces Spanish locale behavior. Under the policy rules, fixed language selection is a natural-language policy concern unless the skill offers user opt-in or clearly justifies that the skill is region-specific.

Content

No source excerpt is available for this finding.