ClawHub
Back to skill

Security audit

Voiceover Teaching Video Factory

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local video-production workflow that handles user-supplied media and writes job outputs without evidence of hidden persistence, credential access, exfiltration, or destructive behavior.

Install only if you are comfortable granting a local video workflow access to the specific media files and output folders you choose. Keep it constrained to a per-job directory, review rights for any source media before publishing, and expect the bundled cover template to favor Simplified Chinese styling unless you modify it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description presents a comprehensive multi-agent video-production workflow. This code chunk does only one small subtask from that broader claim: rendering a cover image. It accepts textual cover content and style JSON, writes an SVG, locates a local Chrome/Chromium/Edge executable, and takes a headless screenshot to produce a PNG of fixed dimensions. That behavior is materially narrower than the declared primary purpose, and the code does not implement the central declared capabilities around audio/video processing, fact-checking, captions, editing, QC, or publishing assets beyond the cover itself. While a cover generator could be a supporting component of the larger skill, the declared description for the skill as a whole does not accurately represent what this supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs the agent to use file reads/writes and shell execution, but it does not declare an explicit tool/permission scope. That creates a policy gap where a host may grant broader access than intended, increasing the risk of unauthorized filesystem access or command execution if the skill is misused or the platform defaults are permissive.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/prepare_voiceover.py (reported line 13)May include surrounding context.

python
def run(command):
    return subprocess.run(command, check=True, capture_output=True, text=True, encoding="utf-8")


def probe_duration(path: Path) -> float:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/prepare_voiceover.py (reported line 71)May include surrounding context.

python
def supports_rubberband() -> bool:
    result = subprocess.run(
        ["ffmpeg", "-hide_banner", "-filters"],
        capture_output=True,
        text=True,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Several visible strings embedded in the generated SVG are fixed in Chinese, including labels and descriptive text. This forces a specific language output regardless of user preference, which is a natural-language locale policy concern when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_cover.py (reported line 136)May include surrounding context.

python
f"--screenshot={output}",
            svg_path.as_uri(),
        ]
        subprocess.run(command, check=False, capture_output=True, timeout=60)
    if not output.is_file():
        raise SystemExit(f"Cover render failed; SVG retained at {svg_path}")
    if png_dimensions(output) != (1080, 1920):

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/validate_delivery.py (reported line 14)May include surrounding context.

python
def run(command):
    return subprocess.run(command, capture_output=True, text=True, encoding="utf-8")


def png_dimensions(path: Path):

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This JSON file includes a natural-language style decision that prioritizes Simplified Chinese-oriented font families (e.g. Microsoft YaHei, PingFang SC, Noto Sans CJK SC) with no indication that the skill is region-specific or that users can opt into another locale. Under the policy rule for language/locale constraints, hard-coding a specific locale without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The instruction "Keep English product names intact" imposes a language-specific constraint in natural language. The file does not indicate user opt-in or a documented region-specific justification for this language policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The code creates parent directories and writes an SVG file, then later writes a PNG screenshot to the requested output path. Although file creation is central to rendering, there is no explicit user-facing disclosure in the script that it will create directories and write files at the provided location.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.