ClawHub
Back to skill

Security audit

video-to-markdown

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it handles powerful credentials and private video data with weaker safeguards than users should accept without review.

Install only if you are comfortable sending video frames, transcripts, and metadata to Claude. Do not run the documented echo command for ANTHROPIC_API_KEY; check whether it is set without printing it. Treat cookies.txt files as account credentials, use a throwaway or dedicated account where possible, keep cookie files out of shared folders and logs, and delete them after use. Prefer public videos and review generated Markdown before trusting links, commands, or claims from it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:40
Finding

API Key Disclosed Through Terminal Output

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/requirements.txt:1
Finding

Unpinned and Non-Reproducible Third-Party Dependency Installation

Content
View full analysis
=0.30.0 Pillow>=10.0.0 faster-whisper>=1.0.0 ``` `scripts/setup.sh`: ```bash if command -v yt-dlp &>/dev/null; then echo "✓ yt-dlp: $(yt-dlp --version)" else echo "Installing yt-dlp..." pip install yt-dlp fi ``` ```bash # For Facebook impersonation support, install yt-dlp with curl-cffi pip install "yt-dlp[default,curl-cffi]" 2>/dev/null || pip install yt-dlp pip install -r "$SCRIPT_DIR/requirements.txt" ``` ### Technical Analysis All listed dependencies resolve mutable versions at installation time. Three packages specify only minimum versions, while `yt-dlp` has no constraint at all. A lower-bound constraint does not guarantee that the installed package is the version reviewed during the audit. The setup script also installs packages directly from pip's configured index without hashes. If the primary installation of `yt-dlp[default,curl-cffi]` fails, the script silently falls back to a materially different installation without the requested extras. This creates exposure to compromised future releases, malicious or incorrectly configured package indexes, dependency substitution, and incompatible package updates. Python package installation and imported package initialization execute code with the privileges of the user running the Skill. ### Attack Path 1. A user executes `bash scripts/setup.sh`. 2. `pip` contacts its configured package index and resolves the latest versions satisfying the loose constraints. 3. A compromised, substituted, or unexpectedly malicious dependency version is downloaded. 4. Package installation hooks or subsequently imported dependency code execute under the user's account. 5. The dependency can access files, environment va ...[truncated 671 chars]
Remediation
View remediation

other

Warning
Location
scripts/video_analyzer.py:278
Finding

Indirect Prompt Injection Through Untrusted Video Content

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/video_analyzer.py:427
Finding

YAML Frontmatter Injection Through Unescaped Remote Video Title

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (27)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 21)May include surrounding context.

text
## Sensitive
cookies.txt
*.cookies
.env

## OS
.DS_Store

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 84)May include surrounding context.

md
se` | Whisper model size (`tiny` / `base` / `small` / `medium` / `large-v3`) |
| `--cookies` | none | Path to cookies.txt (required for Facebook/Instagram) |
| `--model` | `claude-sonnet-4-6` | Claude model to use for analysis |

## Platform support

| Platform | Auth needed | Notes |
|---|---|---|
| YouTube | Usually no | Cookies needed on cloud IPs or age-restricted content |
| Instagram | Yes (cookies) | Firefox cookies; intermittent even with valid session |
| Facebook | Yes (cookies + impersonation) | Auto-handled; requires `curl_cffi` installed |

For cookie setup, see [`references/platforms.md`](references/platforms.md).

## Cost estimate (claude-sonnet-4-6)

| Video length | Frames | Approx. cost |
|---|---|---|
| 10 min | ~20 | ~$0.08 |
| 30 min | ~50 | ~$0.20 |
| 60 min | ~80 | ~$0.35 |

Switch to `claude-haiku-4-5` for ~5× lower cost.

## How it works

1. **Platform detection** — identifies YouTube, Facebook, or Instagram and selects appropriate download flags
2. **Transc

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill sends extracted frames and transcripts to Anthropic for vision analysis, but the description does not clearly warn users that potentially sensitive video content will be transmitted to an external AI provider. This is a privacy and data-governance risk, especially for private, account-restricted, educational, or workplace videos that may contain personal data, confidential visuals, or copyrighted material.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
80% confidence
Finding

The skill instructs users to export browser cookies from a logged-in Firefox session and pass them to the analyzer for Facebook/Instagram access. Although this appears operational rather than overtly malicious, handling reusable session cookies is dangerous because the workflow encourages extraction of authentication material that could be exposed in files, logs, shell history, or mishandled storage, enabling account compromise if leaked.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md
th doing

---

## Troubleshooting

**"No frames extracted"** → Check ffmpeg is installed and the video downloaded to the temp dir. Try `--max-frames 10` on a short public YouTube video first.

**"No captions found" (and no Whisper)** → Normal for non-captioned videos. Install faster-whisper and add `--whisper`, or the analysis continues from frames alone.

**Facebook "Cannot parse data"** → Cookies may be stale or from a different IP. Re-export from Firefox immediately before use, same network.

**Instagram fails with cookies** → Intermittent. Wait a few minutes and retry. Try a different account if it persists.

**Output is too short / missing visuals** → Increase `--max-frames` or upgrade to `--model claude-opus-4-8`.

**High cost** → Reduce `--max-frames` to 20–30. Talking-head content rarely needs more than 20 frames.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
88% confidence
Finding

The documentation instructs users to export authenticated browser cookies and supply them to the tool, including guidance around browser choice, session freshness, and same-IP reuse. Even if framed as operational setup, this meaningfully facilitates handling of sensitive session tokens that could enable account compromise, unauthorized access, or unsafe scraping practices if the cookies file is exposed, reused, or mishandled.

Content

Scanner excerpt · references/platforms.md (reported line 10)May include surrounding context.

md
# Platform Notes

## YouTube

**Auth required:** Only on datacenter/cloud IPs, or for age-restricted/sign-in-required content.

**Captions:** Excellent. Auto-captions available for most English content. Prefer manual captions (`en`) over auto (`en-orig`) when both are present — auto-captions sometimes insert stray `>>` markers.

**Cookie setup (when needed):**
1. Install the "cookies.txt" extension for Firefox
2. Log into youtube.com in Firefox
3. Click the extension → "Export" → save the file
4. Pass: `--cookies /path/to/cookies.txt`
5. Must export from the same IP you're downloading from
6. Cookies expire — re-export every ~2 weeks

**Note:** Chrome cookies are encrypted (app-bound since Chrome 127) and cannot be reliably extracted. Use Firefox.

---

## Instagram

**Auth required:** Yes — public Reels increasingly require a logged-in session.

**Captions:** Rarely available via yt-dlp. Whisper transcription recommended (`--whisper`).

**Cookie setup:**
1

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README documents use of Claude vision for analysis but does not clearly warn users that extracted video frames and transcripts are sent to Anthropic, an external third-party service. This creates a privacy and compliance risk because users may process copyrighted, sensitive, or personal video content without informed consent or awareness of external data transfer.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill invokes shell commands, reads environment variables, and reads/writes files, but it does not declare any tool scope or permission boundaries. That creates an avoidable trust gap: an agent may run networked download/transcription workflows and access local secrets or files without explicit least-privilege constraints or user-visible approval semantics.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger language is extremely broad and includes common phrasings plus automatic triggering on pasted social-media URLs. This increases the chance of unintended invocation, causing the agent to fetch and process external content, incur cost, and transmit user-supplied media to third-party services when the user may only be asking a simple question.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill metadata scopes operation to YouTube, Instagram, and Facebook, but the documentation explicitly broadens behavior to any yt-dlp-supported site. This creates a capability expansion beyond the declared trust boundary, increasing the chance the agent is invoked on unsupported or riskier sites with different authentication, legal, or content-handling requirements.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 21)May include surrounding context.

sh
echo ""
    echo "WARNING: ffmpeg not found. Install it before using this skill:"
    echo "  macOS:          brew install ffmpeg"
    echo "  Ubuntu/Debian:  sudo apt install ffmpeg"
    echo "  Windows:        https://ffmpeg.org/download.html"
    echo ""
fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/video_analyzer.py (reported line 361)May include surrounding context.

python
echo ""
    echo "WARNING: ffmpeg not found. Install it before using this skill:"
    echo "  macOS:          brew install ffmpeg"
    echo "  Ubuntu/Debian:  sudo apt install ffmpeg"
    echo "  Windows:        https://ffmpeg.org/download.html"
    echo ""
fi

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_analyzer.py (reported line 91)May include surrounding context.

python
if platform == "facebook":
        cmd += ["--impersonate", "Chrome-99"]

    subprocess.run(cmd, capture_output=True, text=True)

    title = "Untitled Video"
    info_file = work_dir / "video.info.json"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_analyzer.py (reported line 118)May include surrounding context.

python
if platform == "facebook":
        cmd += ["--impersonate", "Chrome-99"]

    subprocess.run(cmd, capture_output=True, text=True)

    title = "Untitled Video"
    info_file = work_dir / "video.info.json"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_analyzer.py (reported line 156)May include surrounding context.

python
if platform == "facebook":
        cmd += ["--impersonate", "Chrome-99"]

    subprocess.run(cmd, capture_output=True, text=True)

    title = "Untitled Video"
    info_file = work_dir / "video.info.json"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_analyzer.py (reported line 174)May include surrounding context.

python
# Scene-detection pass
    filter_expr = "select='gt(scene\\,0.25)*gte(t-prev_selected_t\\,2)',setpts=N/FRAME_RATE/TB"
    subprocess.run(
        ["ffmpeg", "-i", str(video_path), "-vf", filter_expr,
         "-vsync", "vfr", "-q:v", "2",
         str(frames_dir / "frame_%04d.jpg"), "-y", "-loglevel", "error"],

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_analyzer.py (reported line 187)May include surrounding context.

python
if len(frames) < 5:
        for f in frames:
            f.unlink()
        subprocess.run(
            ["ffmpeg", "-i", str(video_path), "-vf", "fps=1/15",
             str(frames_dir / "frame_%04d.jpg"), "-y", "-loglevel", "error"],
            capture_output=True,

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The code forwards untrusted transcript text verbatim to the LLM and instructs it to extract as much as possible, which encourages reproduction and summarization of any secrets, personal data, or sensitive spoken/captioned content present in the source. In a video-analysis skill, this is more dangerous because videos frequently include API keys on screen, personal details, internal meeting content, or confidential narration that the model will surface into a durable Markdown artifact.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_analyzer.py (reported line 365)May include surrounding context.

python
("yt-dlp", "--version", "pip install yt-dlp"),
    ]:
        try:
            r = subprocess.run([tool, ver_flag], capture_output=True, timeout=20)
        except (FileNotFoundError, subprocess.TimeoutExpired):
            sys.exit(f"[error] '{tool}' not found or timed out. Install: {install_hint}")
        if r.returncode != 0:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill sends extracted video frames and the full transcript to Anthropic for analysis, but there is no explicit consent, warning, redaction step, or policy gate before transmitting potentially sensitive third-party content. In this skill context, users may paste private, copyrighted, or credential-bearing videos, making silent exfiltration to an external API materially risky.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency yt-dlp is completely unpinned, so installs may pull different versions over time, including releases with known security issues or breaking behavior. In a skill that fetches and processes untrusted remote video content, supply-chain drift increases exposure and makes security posture non-reproducible.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text
yt-dlp
anthropic>=0.30.0
Pillow>=10.0.0
faster-whisper>=1.0.0

Unverifiable Dependency: yt-dlp has 16 known advisory(ies) (CVE-2023-46121 (yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection); GHSA-3v33-3wmw-3785 (yt-dlp has dependency on potentially malicious third-party code in Douyu extract); CVE-2023-40581 ( yt-dlp on Windows vulnerable to `--exec` command injection when using `%q`) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
91% confidence
Finding

yt-dlp has multiple known advisories, and because no exact version is pinned, there is no way to verify that deployments avoid affected releases. This skill's purpose—retrieving and processing content from arbitrary social/video URLs—makes weaknesses in the downloader more relevant than in a less exposed application.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

anthropic>=0.30.0 allows any newer version, which can introduce vulnerable or incompatible releases without review. Because this skill likely processes user-supplied content and may handle transcripts or generated documents, uncontrolled dependency upgrades create avoidable supply-chain risk.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text
yt-dlp
anthropic>=0.30.0
Pillow>=10.0.0
faster-whisper>=1.0.0

Unverifiable Dependency: anthropic has 4 known advisory(ies) (CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox); CVE-2026-34450 (The Claude SDK for Python provides access to the Claude API from Python applicat) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
81% confidence
Finding

The anthropic package has known advisories, and without exact pinning the manifest cannot prove whether the installed version is patched. The context is somewhat less directly dangerous than the media-parsing stack, but it still creates avoidable uncertainty around SDK behavior and local file handling.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

Pillow>=10.0.0 is not pinned to a specific version, so builds are not reproducible and may consume a later release with unresolved image-parsing issues. Since this skill analyzes extracted video frames, it directly relies on image handling of potentially untrusted media, making dependency hygiene more important.

Content

Scanner excerpt · scripts/requirements.txt (reported line 3)May include surrounding context.

text
yt-dlp
anthropic>=0.30.0
Pillow>=10.0.0
faster-whisper>=1.0.0

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
92% confidence
Finding

Pillow has a long history of image parsing vulnerabilities, and the unpinned requirement makes it impossible to verify that only a patched version will be installed. Because this skill processes video frames and images derived from user-provided URLs, a vulnerable image library is more dangerous in this context than in a package that never handles untrusted media.

Content

No source excerpt is available for this finding.