Course Builder Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:50 AM UTC
• Version: 1.0.0

Overview

This skill is a plausible course-video generator, but it asks for risky system-level installation and advertises external digital-human/photo handling that is not clearly implemented or disclosed.

Review before installing. The skill can generate local slide-and-audio videos, but do not assume the advertised digital-human or subtitle embedding features actually work. Avoid providing personal photos unless the publisher adds clear third-party privacy terms and explicit consent controls. Install only in an isolated virtual environment or container, because the current install command can alter the host Python environment with unpinned dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: claw.json:10

Finding

Unpinned Dependencies Installed into the System Python Environment

Content

View full analysis

Vulnerability Details

File Location: claw.json, line 10
Vulnerability Type: Unpinned third-party dependencies and unsafe system-level package installation
Risk Level: Medium

Vulnerable Code

json

"commands": ["pip3 install edge-tts Pillow --break-system-packages || pip install edge-tts Pillow"],

Technical Analysis

The installation command retrieves edge-tts and Pillow without fixed versions or package hashes. Consequently, the code installed during deployment can differ from the code assessed during this audit. If a dependency, transitive dependency, package index, or distribution account is compromised, a malicious release could be selected and installed.

The primary command also uses --break-system-packages, bypassing protections intended to prevent pip from modifying an externally managed system Python environment. This can overwrite or introduce conflicts with operating-system-managed packages. The fallback command remains unpinned and does not isolate dependencies in a virtual environment.

The reviewed evidence does not establish that the currently published dependencies are malicious. The vulnerability is the uncontrolled supply-chain and installation process.

Attack Path

1. An attacker compromises a dependency or transitive dependency release, its publisher account, or the package source used by pip.
2. The attacker publishes a malicious version that satisfies the unconstrained dependency request.
3. A user installs the skill, causing pip to resolve and download that version.
4. Package installation hooks, imported modules, or runtime code execute on the host.
5. The malicious package acts with the privileges of the user or service account performing installation or running the skill.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the installer or runtime account. Depending on those privileges, an attacker could access that account's files ...[truncated 378 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an audited version, for example:

   text

   edge-tts==<reviewed-version>
   Pillow==<reviewed-version>
   

2. Generate a lock file that includes all transitive dependencies and cryptographic hashes. Install with hash verification, such as:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Install dependencies inside a dedicated virtual environment rather than the system Python environment:

   bash

   python3 -m venv .venv
   .venv/bin/python -m pip install --require-hashes -r requirements.txt
   

4. Remove --break-system-packages and do not fall back to an unisolated, unpinned installation.

5. Configure an approved package index or internal artifact repository and enforce TLS certificate validation.

6. Scan and review dependency updates before modifying pinned versions, including transitive dependency and provenance checks.

7. Run installation and media generation under a non-privileged service account with restricted filesystem and network access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill advertises a full pipeline including digital-human output and subtitle integration, but the documented behavior indicates some of these features are placeholders or not actually used in final composition. This mismatch can mislead users into uploading photos or trusting outputs to contain expected processing steps, creating privacy, integrity, and informed-consent risks rather than a direct exploit primitive.

Content

No source excerpt is available for this finding.

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 95% confidence

Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · scripts/build.py (reported line 59)May include surrounding context.

python

def generate_tts(text, voice, output):
    """生成TTS配音"""
    subprocess.run([
        "edge-tts", "--voice", voice,
        "--text", text,
        "--write-media", output

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 95% confidence

Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · scripts/build.py (reported line 65)May include surrounding context.

python

"--write-media", output
    ], check=True, timeout=120)
    
    result = subprocess.run(
        ["ffprobe", "-v", "error", "-show_entries", "format=duration", "-of", "csv=p=0", output],
        capture_output=True, text=True
    )

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill describes capabilities that imply file read/write and shell execution, but it does not declare any tool scope or permission boundaries. This creates an authorization ambiguity where an agent runtime may grant broader access than users expect, increasing the risk of unintended file access, overwriting artifacts, or command execution during video generation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The description explicitly says the pipeline generates Chinese slides, and later sections reinforce Chinese-only defaults such as 中文幻灯片 and zh-CN voices, but no user opt-in or locale choice is presented. This is a natural-language locale policy concern because the skill appears to impose a specific language behavior by default rather than offering a choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to upload a photo to an external digital-human service without a clear warning that biometric or personal image data leaves the local environment. In this context, the omitted disclosure is dangerous because users may provide sensitive likeness data without understanding third-party processing, retention, or model-cloning implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The display name and description specify a Chinese-only workflow, including '中文幻灯片' and Chinese command examples, with no indication that users can choose another language or locale. This is a natural-language policy concern because the skill appears to impose a specific language by default rather than offering user choice or documenting a justified regional restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The default voice is fixed to zh-CN-XiaoxiaoNeural, and the script’s user-facing description/messages are entirely Chinese, which effectively constrains the skill to a specific language/locale without user opt-in. The policy allows locale constraints only when clearly documented and justified or when users are explicitly given a language choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/build.py (reported line 59)May include surrounding context.

python

def generate_tts(text, voice, output):
    """生成TTS配音"""
    subprocess.run([
        "edge-tts", "--voice", voice,
        "--text", text,
        "--write-media", output

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/build.py (reported line 65)May include surrounding context.

python

"--write-media", output
    ], check=True, timeout=120)
    
    result = subprocess.run(
        ["ffprobe", "-v", "error", "-show_entries", "format=duration", "-of", "csv=p=0", output],
        capture_output=True, text=True
    )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 83% confidence

Finding

This ffmpeg invocation consumes a concat manifest built from filenames derived from the contents of a directory, while explicitly setting -safe 0 to relax path safety checks. If an attacker can influence files placed in slides_dir or their names, ffmpeg may be directed to process unexpected file paths, creating a local file inclusion/trust-boundary issue around media processing.

Content

Scanner excerpt · scripts/build.py (reported line 172)May include surrounding context.

python

slides_video = output_path + ".slides.mp4"
    
    # 生成幻灯片视频
    subprocess.run([
        "ffmpeg", "-y",
        "-f", "concat", "-safe", "0",
        "-i", concat_file,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/build.py (reported line 184)May include surrounding context.

python

# 裁剪到音频长度
    slides_trim = output_path + ".trim.mp4"
    subprocess.run([
        "ffmpeg", "-y", "-i", slides_video,
        "-t", str(duration), "-c", "copy",
        slides_trim

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/build.py (reported line 191)May include surrounding context.

python

], check=True, capture_output=True)
    
    # 合成最终视频
    subprocess.run([
        "ffmpeg", "-y",
        "-i", slides_trim,
        "-i", audio_path,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes a full pipeline including '数字人驱动' and specifically names 飞影数字人 as part of the generated courseware video workflow. In the code, the digital-human step is only a placeholder printout and no API call, processing step, or video composition involving a digital human actually occurs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The comment '# 7. 数字人（可选）' and surrounding stage numbering present this as an actual processing step in the build pipeline. However, the implementation merely prints that MCP configuration is pending, which contradicts the implication that a digital-human operation is being performed.

Content

No source excerpt is available for this finding.