ClawHub
Back to skill

Security audit

Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it claims, but it installs mutable external code and may automatically use Chrome browser cookies for YouTube conversions without clear user consent.

Install only if you are comfortable with a third-party converter installed from a mutable GitHub source and with YouTube retries potentially accessing Chrome session cookies. Prefer running it in an isolated environment, avoid sensitive browser profiles, and review or pin the dependency before use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:23
Finding

Installation of an Unpinned Dependency from a Mutable Git Repository

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21–23 and 107–109
Vulnerability Type: Supply-chain exposure through an unpinned Git dependency
Risk Level: High

Vulnerable Code:

yaml
    - kind: uv
      packages: [anything-to-md@git+https://github.com/haiwenai/anything-to-md.git]
markdown
- If `tomd` is not found, install it: `uv pip install "anything-to-md[video] @ git+https://github.com/haiwenai/anything-to-md.git"`

Technical Analysis

The Skill installs executable Python package code directly from the mutable default branch of an external Git repository. Neither installation instruction specifies a reviewed commit hash, immutable release artifact, package hash, or cryptographic signature.

Consequently, the code installed by these instructions can change after the Skill has been audited. Package installation may execute build-system logic, while subsequent tomd invocations execute the installed runtime code with the privileges of the user running the Agent.

The repository is presented as the intended upstream project, and the reviewed file contains no evidence that it is currently malicious. The vulnerability is the absence of an immutable, independently verifiable dependency reference.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, or another component of its release process.
  2. The attacker modifies the repository's default branch to include malicious build or runtime code.
  3. A user or Agent follows the installation metadata or documented recovery command.
  4. uv retrieves the current, attacker-modified repository content rather than the version originally reviewed.
  5. Malicious code executes during installation or when the Agent subsequently invokes tomd.

Impact Assessment

Successful exploitation permits arbitrary code execution with the permissions of the account installing or running the package. Dependin ...[truncated 396 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a specific, reviewed Git commit hash instead of the repository's mutable default branch.
  • Prefer an immutable release artifact from a trusted package registry.
  • Require cryptographic hashes through a locked requirements file or equivalent hash-verification mechanism.
  • Verify release signatures or provenance attestations where available.
  • Ensure both installation paths reference exactly the same reviewed version.
  • Perform dependency installation in an isolated environment with minimal filesystem, credential, and network access.
  • Establish an update process that requires review and testing before changing the pinned version.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:112
Finding

Automatic Access to Chrome Authentication Cookies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 112
Vulnerability Type: Automatic access to sensitive browser session credentials
Risk Level: Medium

Vulnerable Code:

markdown
- If YouTube returns "Sign in to confirm you're not a bot", `tomd` will automatically retry with browser cookies from Chrome

Technical Analysis

The documented fallback automatically reads Chrome cookies when an anonymous YouTube request is rejected. Browser cookies may contain authenticated session material and therefore represent sensitive credentials.

The fallback is triggered by a remote service response rather than a separate, explicit user authorization step. The documentation does not identify which Chrome profile is accessed, which cookies are selected, how they are stored or logged, or whether the user can reject the fallback while retaining a safe failure mode.

Cookie use may be functionally relevant to retrieving a protected video, but automatic access exceeds the privileges needed for ordinary anonymous URL conversion. Because the dependency implementation is not included in the audited project, this audit cannot establish that cookies are exfiltrated or mishandled; the confirmed issue is the documented automatic credential access and the lack of stated safeguards.

Attack Path

  1. A user requests conversion of a YouTube URL and expects an anonymous retrieval.
  2. YouTube returns the documented bot-verification or sign-in response.
  3. tomd automatically invokes its browser-cookie fallback without a separate confirmation.
  4. The dependency reads applicable cookies from a Chrome profile.
  5. The cookies are used to issue an authenticated request to YouTube and become accessible to the dependency's process.
  6. If the dependency or its execution environment is compromised, that access can be abused to capture or misuse the session material.

Impact Assessment

The direct scope is access to Chrom ...[truncated 501 chars]

Remediation
View remediation

Remediation Suggestions

  • Disable automatic browser-cookie fallback by default.
  • Require explicit, per-request user consent before reading browser cookies.
  • Clearly identify the browser profile, destination service, cookie scope, and purpose before requesting consent.
  • Allow users to fail safely or provide an independently exported, narrowly scoped cookie file.
  • Select only cookies required for the intended YouTube request rather than exposing an entire browser cookie store.
  • Prevent cookie values from appearing in command output, logs, generated Markdown, temporary files, or error messages.
  • Store any necessary temporary credential material with restrictive permissions and delete it immediately after use.
  • Run the converter in an isolated process with access only to explicitly approved credential material.
  • Document session revocation procedures and test the dependency's cookie-handling implementation before enabling this feature.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
84% confidence
Finding

The YARA hit is triggered by documented use of Chrome cookies. While this does not by itself prove malware or credential theft, it does indicate credential-adjacent access to sensitive browser data that could be abused if the underlying tool reads cookies automatically. In a markdown conversion skill, this is suspicious and materially riskier than the advertised purpose suggests.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
Transcript` section with timestamped text.

## Error Handling

- If `tomd` is not found, install it: `uv pip install "anything-to-md[video] @ git+https://github.com/haiwenai/anything-to-md.git"`
- If `ffmpeg` is not found: `brew install ffmpeg`
- If `yt-dlp` is not found: `brew install yt-dlp`
- If YouTube returns "Sign in to confirm you're not a bot", `tomd` will automatically retry with browser cookies from Chrome
- Use `-v` flag for detailed error diagnosis

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly documents that it will automatically retry YouTube access using Chrome browser cookies. Accessing local browser cookies can expose authenticated session material and performs sensitive credential-adjacent behavior without an explicit consent prompt or prominent warning. In the context of a URL/file conversion skill, this behavior exceeds user expectations and increases risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation omits an upfront warning in the skill description that Chrome cookies may be accessed automatically for YouTube retries. Users invoking a content-conversion skill would not reasonably expect browser session data to be used, so the lack of disclosure undermines informed consent and can lead to unintended exposure of authenticated data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The markdown advertises -o <path> and -d <dir> options that save output to a file or directory, but it does not warn users that these options create or overwrite local files. Because writing to the filesystem can affect user data, the skill description should disclose this behavior.

Content

No source excerpt is available for this finding.