ClawHub
Back to skill

Security audit

Podcast To Script

Security checks for vulnerabilities and agentic risk

Overview

This skill performs a disclosed podcast transcription and Chinese script workflow, with expected local files, network fetches, and an explicit dependency install step.

Install only if you are comfortable letting the skill run Python scripts, fetch podcast/audio/image/transcript URLs, store episode artifacts in a temp working directory, and optionally install faster-whisper plus model data. Review before using --install in managed environments, and avoid feeding it private or untrusted URLs unless you are comfortable with the resulting local downloads and transcript outputs.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
candidates.append([sys.executable, "-m", "pip", "install", "--user", "faster-whisper"])
    for cmd in candidates:
        print(f"[install] {' '.join(cmd)}", flush=True)
        if subprocess.run(cmd).returncode == 0:
            return True
        print(f"[install] failed, trying next installer...")
    return False
Confidence
88% confidence
Finding
The preflight path can automatically install packages by invoking external package managers ('uv' or 'pip') and then later load the installed code into the current interpreter. In a hostile or misconfigured environment, this expands trust to PATH-resolved executables, package indexes, mirrors, and dependency supply chain components, so running preflight with --install can execute untrusted code or install a tampered package.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to run Python scripts, access environment/dependencies, read and write episode files, and fetch remote podcast/audio URLs, but it does not declare corresponding permissions. This creates a capability/expectation mismatch that can lead to silent overreach, unsafe execution in permissive runtimes, or deployment into environments where operators cannot accurately assess the skill's trust boundary.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/pipeline.py:41

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/run_tests.py:57