ClawHub
Back to skill

Security audit

Pinterest Video Download

Security checks for vulnerabilities and agentic risk

Overview

The skill is a plausible Pinterest video downloader, but its helper script can fetch any media URL and overwrite any writable file path, so it needs review before installation.

Install only if you are comfortable with a skill that may run ffmpeg, access network media URLs, and write local files. Before use, constrain it to Pinterest or pinimg media URLs, save only under the intended downloads directory, and avoid overwriting existing files unless you explicitly choose to replace them.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/download_pinterest_video.py:11
Finding

Unrestricted Media Input and Arbitrary Output Path Permit Network Access and File Overwrite

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared purpose says this skill should take a Pinterest pin URL or short link and download the main video from that pin. The code does not interact with Pinterest at all: it expects exactly two arguments, an m3u8 URL and an output filename, then shells out to ffmpeg to copy the stream to disk. While saving a video file is directionally related, the primary advertised behavior—handling Pinterest URLs and extracting the pin’s main video—is missing. This is a material description/behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill implicitly requires shell-capable operations such as invoking ffmpeg, ffprobe, and possibly package installation, but it declares no tool restrictions or permissions. This creates an authorization gap where the runtime may grant broader-than-expected execution capability, making command execution and filesystem writes less transparent and harder to govern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill directs the agent to create local files in a persistent downloads directory without requiring explicit user acknowledgment of the write location or storage side effects. Unannounced file creation can surprise users, leak sensitive media into shared environments, or contribute to disk consumption and persistence of unwanted content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The implementation does not enforce the documented skill scope of accepting a Pinterest pin URL and instead downloads from any attacker-supplied m3u8 URL. In an agent context, this can turn the skill into a generic network fetcher and local file writer, enabling SSRF-style access to internal services or retrieval of untrusted content outside the intended Pinterest-only workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script performs a remote download and forcibly overwrites the destination file with ffmpeg -y without any confirmation, disclosure, or safety checks. In an automated agent workflow, this increases the chance of destructive file clobbering and silent retrieval of untrusted network content, especially when output paths or URLs are influenced by external input.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download_pinterest_video.py (reported line 25)May include surrounding context.

python
"copy",
        str(output),
    ]
    return subprocess.run(cmd, check=False).returncode


if __name__ == "__main__":

Static analysis

No suspicious patterns detected.