ClawHub
Back to skill

Security audit

video

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently generates videos through a disclosed external API, with ordinary API-key use but some privacy and hardening caveats.

Install only if you are comfortable sending prompts, optional reference images, and the SkillBoss API key to the external SkillBoss/HeyBoss API. Avoid regulated or sensitive media unless your organization approves that service, and prefer running it in a constrained environment with reviewed dependency locking if you use it regularly.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/generate_video.py:2
Finding

Unpinned Runtime Dependency Resolution

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_video.py, lines 2-6
Vulnerability Type: Supply-chain exposure through unpinned runtime dependencies
Risk Level: Medium

Vulnerable Code:

python
# /// script
# requires-python = ">=3.10"
# dependencies = [
#     "requests>=2.28.0",
# ]

Technical Analysis

The documented execution method uses uv run, while the script specifies requests>=2.28.0 without an exact version, lockfile, or integrity hash. This permits dependency resolution to select future versions of requests and its transitive dependencies at execution time.

Consequently, the code reviewed during the audit is not the complete immutable set of code that may execute. A compromised package release, package-index compromise, unsafe index configuration, or unexpectedly incompatible future release could introduce code that runs with the same permissions as the Skill.

This is a supply-chain weakness rather than evidence that the current requests package is malicious.

Attack Path

  1. An attacker compromises a permitted dependency release, a transitive dependency, the configured package index, or dependency-resolution infrastructure.
  2. The user invokes the documented uv run command in an environment where the affected dependency is not already securely cached and locked.
  3. uv resolves the open-ended dependency constraint and installs the attacker-controlled package version.
  4. Malicious package code executes when imported or otherwise initialized by the script.
  5. That code runs with the user's permissions and may access data available to the video-generation process.

Impact Assessment

Exploitation would provide code execution with the privileges of the user running the Skill. Accessible assets could include:

  • The SKILLBOSS_API_KEY environment variable.
  • Video prompts and selected reference images.
  • Files readable by the invoking user ...[truncated 298 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin requests and all transitive dependencies to reviewed, exact versions.
  • Commit and enforce a uv.lock file rather than resolving unrestricted versions at each run.
  • Use package integrity hashes where supported.
  • Configure dependency installation to use only an explicitly trusted package index.
  • Perform automated vulnerability and provenance checks when updating the lockfile.
  • Review dependency updates before deployment and avoid automatic adoption of newly published versions.
  • Consider running the Skill in a restricted environment with only the filesystem and network access required for video generation.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_video.py:119
Finding

Unvalidated and Unbounded API-Directed Video Download

Content
View full analysis

Vulnerability Details

File Location: scripts/generate_video.py, lines 119-126
Vulnerability Type: Untrusted URL retrieval and unbounded response handling
Risk Level: Medium

Vulnerable Code:

python
result = pilot(body)
video_url = result["result"]["video_url"]

# Download the video
print(f"Downloading video from {video_url}...")
video_resp = requests.get(video_url, timeout=120)
video_resp.raise_for_status()
output_path.write_bytes(video_resp.content)

Technical Analysis

The URL returned by the remote API is passed directly to requests.get() without validating its scheme, hostname, port, redirect chain, or final destination. The remote service therefore controls an additional network request made from the user's environment.

The implementation does not require HTTPS or restrict downloads to approved media-storage hosts. Because requests follows redirects by default, validating only the initial URL would also be insufficient unless every redirect and the final URL were checked.

The response is accessed through video_resp.content, which buffers the complete body in memory before writing it to disk. A request timeout does not impose a maximum response size. The implementation also does not validate the response's content type or confirm that the downloaded bytes represent an MP4 file.

Attack Path

  1. The Skill sends a legitimate video-generation request to the configured API.
  2. The API, an upstream component, or a compromised API account returns an attacker-selected video_url.
  3. The URL points directly—or redirects—to an unintended external service, an address reachable only from the user's network, or a server returning an oversized payload.
  4. The script automatically performs the GET request from the user's host.
  5. The response is fully loaded into memory and then written to the user-selected output path without media validation.
  6. Depending on the supplied URL and ...[truncated 1030 chars]
Remediation
View remediation

Remediation Suggestions

  • Require the returned URL to use HTTPS.
  • Allow downloads only from explicitly approved media-storage hostnames and ports.
  • Resolve and validate destination addresses where appropriate, rejecting loopback, link-local, private, multicast, and other non-public ranges unless specifically required.
  • Disable automatic redirects or validate every redirect target and the final URL against the same policy.
  • Use stream=True and write the response incrementally to a temporary file.
  • Enforce a strict maximum download size using both Content-Length, when present, and a running byte counter.
  • Validate the response media type against an allowlist such as video/mp4.
  • Verify the downloaded file signature or container format before accepting it.
  • Delete partial files on error and atomically rename the validated temporary file to the requested output path.
  • Avoid printing complete signed download URLs; redact query strings or sensitive tokens from logs.
  • Use separate connection and read timeouts and handle malformed API responses explicitly.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Tainted flow: 'SKILLBOSS_API_KEY' from os.environ (line 24, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate_video.py (reported line 29)May include surrounding context.

python
def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to supply prompts and optionally input images to a third-party service via SkillBoss API Hub, but it does not disclose that this content leaves the local environment. This can lead users to submit sensitive text or media under the false assumption that processing is local, creating privacy, confidentiality, and compliance risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_video.py (reported line 25)May include surrounding context.

python
from pathlib import Path

SKILLBOSS_API_KEY = os.environ["SKILLBOSS_API_KEY"]
API_BASE = "https://api.heybossai.com/v1"


def pilot(body: dict) -> dict:

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_video.py (reported line 29)May include surrounding context.

python
def pilot(body: dict) -> dict:
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

Tainted flow: 'video_resp' from requests.get (line 127, network input) → pathlib.Path.write_bytes (file write)

Medium
Category
Data Flow
Confidence
93% confidence
Finding

The script downloads a URL returned by the remote API and writes the response bytes directly to a user-chosen path without validating the URL origin, content type, or file size. If the upstream service is compromised or returns an attacker-controlled URL, this can enable untrusted content to be written locally, potentially causing disk exhaustion or planting unexpected files.

Content

Scanner excerpt · scripts/generate_video.py (reported line 129)May include surrounding context.

python
print(f"Downloading video from {video_url}...")
        video_resp = requests.get(video_url, timeout=120)
        video_resp.raise_for_status()
        output_path.write_bytes(video_resp.content)

        # Verify and report
        if output_path.exists():