ClawHub
Back to skill

Security audit

clipping-video-highlights

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible video-highlighting tool, but it publishes a live-looking MiniMax API key and can send the wrong local subtitle file to an external AI service.

Install only after the MiniMax key has been revoked and removed, documentation is corrected, and subtitle handling is fixed to use a per-run working directory or exact downloaded subtitle path. Treat any video subtitles processed by this skill as data sent to MiniMax, and avoid using shared output folders containing private SRT files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:39
Finding

Hard-Coded MiniMax API Credential in Skill Documentation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
clipper.py:51
Finding

Unrelated Local Subtitle Files Can Be Submitted to an External AI Service

Content
View full analysis
list: """让MiniMax LLM从字幕文本选高光时间点""" with open(subtitle_file, "r", encoding="utf-8") as f: sub_text = f.read()[:8000] # 限制字数 ``` ```python content = _mmx_chat(prompt, max_tokens=512) ``` The external call is performed here: ```python r = subprocess.run( ["mmx", "text", "chat", "--message", prompt, "--model", "MiniMax-M2.7", "--max-tokens", str(max_tokens), "--output", "json"], capture_output=True, text=True, timeout=120 ) ``` ### Technical Analysis The output directory is supplied by the caller and may contain subtitle files from previous jobs or unrelated confidential material. After `yt-dlp` runs, the program does not identify the exact file generated for the requested video. Instead, it enumerates all `*.srt` files and selects `subs[0]`, whose ordering and association with the current download are not validated. The first 8,000 characters of the selected subtitle are then embedded in a prompt and provided to `mmx text chat`. According to the declared workflow, `mmx` communicates with the MiniMax service. Sending the ...[truncated 1651 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
package-lock.json:14
Finding

Unused SDK Dependency Is Retrieved from a Third-Party npm Mirror

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The documented behavior does not accurately match what the skill actually does, including unsupported local video handling, omitted video downloading, and claimed COS integration that is not implemented. Security-relevant mismatches undermine informed consent and review, because users and operators cannot reliably predict what data will be processed or what external actions will occur.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

A specific API key is embedded directly in the skill documentation, which is a direct secret disclosure. Anyone who reads the file may reuse the credential to consume the service, incur charges, or impersonate the project when calling the provider.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
79% confidence
Finding

The skill advertises behavior that clearly requires shell execution and file read/write, but it does not declare any tool scope or permissions boundaries. That increases the chance the agent will execute powerful local operations without explicit review, making misuse or overbroad access harder to govern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends subtitle or content-derived data to external AI services and references cloud services, but it does not clearly warn users about that data transfer. This creates a privacy and compliance risk, especially if the video content contains sensitive, copyrighted, or regulated information.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation exposes hard-coded external service credentials/configuration, including a MiniMax API key and cloud service configuration. Embedded secrets can be copied by anyone with repository access and abused for unauthorized API usage, billing fraud, or pivoting into associated cloud resources.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · clipper.py (reported line 24)May include surrounding context.

python
# ── 依赖检查 ──────────────────────────────────────
def check_deps():
    for cmd in ["ffmpeg", "ffprobe", "yt-dlp"]:
        if subprocess.run(["which", cmd], capture_output=True).returncode != 0:
            raise RuntimeError(f"缺少命令: {cmd}")
    return True

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The code explicitly prioritizes English and Chinese subtitle languages and the surrounding natural-language comments reinforce that fixed preference. This imposes a language/locale choice on users without opt-in or configuration, which matches the policy-violation category for forced language behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · clipper.py (reported line 42)May include surrounding context.

python
"-o", "%(title)s.%(ext)s",
        video_url
    ]
    r = subprocess.run(cmd, capture_output=True, text=True)
    if r.returncode != 0:
        raise RuntimeError(f"yt-dlp失败: {r.stderr[:200]}")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · clipper.py (reported line 66)May include surrounding context.

python
重要：max_tokens必须足够大（≥2000），否则thinking过程占用所有token导致content为空
    """
    r = subprocess.run(
        ["mmx", "text", "chat", "--message", prompt,
         "--model", "MiniMax-M2.7", "--max-tokens", str(max_tokens),
         "--output", "json"],

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script reads subtitle content and sends it to an external MiniMax service without an explicit user-facing consent or warning. Subtitles can contain sensitive, private, copyrighted, or regulated content, so this creates a real data-exfiltration/privacy risk in a media-processing skill that users may expect to run locally except for obvious generation steps.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · clipper.py (reported line 134)May include surrounding context.

python
"""用MiniMax图片生成封面"""
    prompt = f"{topic}短视频封面，高清，16:9，文字：「{title[:10]}」，专业感，抖音风格"
    
    r = subprocess.run(
        ["mmx", "image", "generate",
         "--prompt", prompt,
         "--aspect-ratio", "16:9",

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
82% confidence
Finding

Converting an attacker-controlled subtitle file with ffmpeg can expose the host to parser-level vulnerabilities in complex multimedia tooling. In this skill, subtitles are fetched from remote sources and then handed directly to ffmpeg, increasing risk if a malformed file triggers a crash or exploit in the media stack.

Content

Scanner excerpt · clipper.py (reported line 163)May include surrounding context.

python
# 将字幕SRT转换为ASS格式（支持样式）
    ass_file = output_path.replace(".mp4", ".ass")
    cmd = ["ffmpeg", "-y", "-i", subtitle_file, ass_file]
    subprocess.run(cmd, capture_output=True)
    
    # 如果视频存在，直接裁剪；否则需要先下载
    if video_downloaded and Path(video_downloaded).exists():

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · clipper.py (reported line 177)May include surrounding context.

python
"-o", f"{temp_dir}/clip.mp4",
            video_url
        ]
        r = subprocess.run(dl_cmd, capture_output=True, text=True)
        if r.returncode != 0:
            raise RuntimeError(f"下载片段失败: {r.stderr[:100]}")
        input_video = f"{temp_dir}/clip.mp4"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · clipper.py (reported line 192)May include surrounding context.

python
"-threads", "2",
        output_path
    ]
    r = subprocess.run(cut_cmd, capture_output=True, text=True)
    if r.returncode != 0:
        # 字幕烧录失败，但视频已裁剪，输出无字幕版本
        cut_cmd_no_sub = [

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · clipper.py (reported line 202)May include surrounding context.

python
"-c:a", "copy",
            output_path
        ]
        subprocess.run(cut_cmd_no_sub, capture_output=True)
    
    return output_path

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description says the skill handles 'YouTube链接/本地视频', but the main flow only accepts a YouTube URL and always calls yt-dlp-based subtitle extraction and clip downloading. There is no code path for opening a local video file, extracting subtitles from it, or clipping it directly as a local source.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring lists 'ffmpeg 提取音频' and '腾讯COS存储' as workflow steps, but no function performs audio extraction and no code uploads outputs to Tencent COS. This creates a mismatch between the documented behavior of the skill and its actual operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

Several ffmpeg invocations use the -y flag, which overwrites files without prompting, and the script also copies generated cover images into the output directory. While the script prints progress messages, it does not clearly warn the user that files in the chosen output path may be replaced automatically.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The dependency uses a caret range (^0.2.0), which allows installation of newer compatible releases rather than an exact reviewed version. This creates supply-chain risk because a later published package version could introduce malicious code or breaking behavior without any change to this repository.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json
"author": "",
  "license": "ISC",
  "dependencies": {
    "@clawvard/sdk": "^0.2.0"
  }
}