ClawHub
Back to skill

Security audit

WJS Burning Subtitles

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it can automatically download and run an unpinned third-party ffmpeg binary without mandatory checksum verification.

Review before installing. Prefer using a locally installed ffmpeg with libass from a trusted package manager. If you use this skill’s auto-download fallback, set a known-good EVERMEET_FFMPEG_SHA256 value first and understand that the downloaded executable will run with your user privileges.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill explicitly directs use of shell commands, network access, and environment-dependent tooling, yet the metadata declares no permissions. That mismatch is dangerous because it hides the skill's true execution capabilities from reviewers and any permission-gating system, making risky actions like downloads and command execution occur without clear user or platform scrutiny.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill can download an executable ffmpeg binary from the internet and then run it locally, which expands the trust boundary from local media processing to remote code acquisition. In a subtitle-rendering utility this is especially dangerous because the fetched binary executes with the user's privileges, so a compromised host, malicious update, or MITM/TLS trust failure could lead to arbitrary code execution.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The docstring states that SHA256 verification protects against supply-chain tampering, but the implementation leaves the hash empty by default and therefore skips verification entirely unless an environment variable is set. This creates a misleading safety guarantee and means the script may execute an unverified internet-downloaded binary, enabling arbitrary code execution if the download source is compromised.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs downloading a third-party ffmpeg binary from the internet into /tmp and then executing it, but provides no integrity verification, signature/checksum validation, pinning, or trust warning. This creates a supply-chain and remote code execution risk: if the source, connection, DNS, or mirror is compromised, the agent may run attacker-controlled code on the host.

Static analysis

No suspicious patterns detected.