ClawHub
Back to skill

Security audit

media-use

Security checks for vulnerabilities and agentic risk

Overview

This is a broad media helper with real network, credential, telemetry, and cross-project caching behavior, but the behavior is mostly disclosed and aligned with media generation and reuse.

Install this only if you are comfortable with a media workflow that can use provider credentials, call external media services, write project media files, keep a cross-project `~/.media` cache, and send coarse opt-out telemetry. Avoid using it in untrusted repositories with sensitive `.env` files unless you understand which credentials it may load.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (187)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description is about a broad media operating system for asset resolution, generation, audio/video processing, and media transformations. The supplied code does none of that directly. Instead, it is a narrow authentication utility for obtaining Gemini OAuth headers via service-account credentials. While this could be a supporting component inside a larger system, the chunk itself implements cloud authentication behavior that is not described in the declared purpose. Its primary purpose is materially different from media resolution or processing, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is about a media asset OS handling media resolution, generation, transformation, and reuse. The supplied code chunk does none of that. It is a test file focused on authentication logic for Google/Gemini credentials, including service-account parsing, scope enforcement, token refresh behavior, project ID selection, rejection of unauthorized credential types, and sanitization of error messages. This is a materially different primary purpose and introduces undeclared capabilities around credential management and security testing that are unrelated to the described media functionality.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The documentation instructs users to place HEYGEN_API_KEY in a project .env, and the surrounding text describes automatic loading by scripts. Storing sensitive API credentials in project directories increases the chance of accidental commit, leakage to other tooling, or unintended reuse across contexts.

Content

Scanner excerpt · audio/references/tts.md (reported line 74)May include surrounding context.

bash
# Only needed if you haven't run `npx hyperframes auth login`:
export HEYGEN_API_KEY=...   # or put it in a project .env

# Synthesize + capture word timestamps in one call (skips a Whisper pass)
node skills/media-use/audio/scripts/heygen-tts.mjs \

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · audio/scripts/gemini-pipeline.test.mjs (reported line 67)May include surrounding context.

js
{ mode: 0o755 },
      );
      writeFileSync(join(bin, "ffprobe"), "#!/bin/sh\necho 1.25\n", { mode: 0o755 });
      writeFileSync(join(dir, ".env"), "");
      writeFileSync(
        join(dir, "audio_request.json"),
        JSON.stringify({

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · audio/scripts/lib/heygen.test.mjs (reported line 141)May include surrounding context.

js
{ mode: 0o755 },
      );
      writeFileSync(join(bin, "ffprobe"), "#!/bin/sh\necho 1.25\n", { mode: 0o755 });
      writeFileSync(join(dir, ".env"), "");
      writeFileSync(
        join(dir, "audio_request.json"),
        JSON.stringify({

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · audio/scripts/lib/heygen.test.mjs (reported line 142)May include surrounding context.

js
{ mode: 0o755 },
      );
      writeFileSync(join(bin, "ffprobe"), "#!/bin/sh\necho 1.25\n", { mode: 0o755 });
      writeFileSync(join(dir, ".env"), "");
      writeFileSync(
        join(dir, "audio_request.json"),
        JSON.stringify({

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · audio/scripts/lib/heygen.test.mjs (reported line 156)May include surrounding context.

js
{ mode: 0o755 },
      );
      writeFileSync(join(bin, "ffprobe"), "#!/bin/sh\necho 1.25\n", { mode: 0o755 });
      writeFileSync(join(dir, ".env"), "");
      writeFileSync(
        join(dir, "audio_request.json"),
        JSON.stringify({

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · audio/scripts/heygen-voice.test.mjs (reported line 141)May include surrounding context.

js
assert.equal(calls.length, 0);
});

test("delete calls DELETE /voices/<id> and exits 0", async () => {
  mockFetch({ "DELETE /voices/vc1": [[200, { data: {} }]] });
  const r = await run(["delete", "vc1"]);
  assert.deepEqual(r, { code: 0, out: "", err: "" });

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · audio/scripts/heygen-voice.test.mjs (reported line 142)May include surrounding context.

js
});

test("delete calls DELETE /voices/<id> and exits 0", async () => {
  mockFetch({ "DELETE /voices/vc1": [[200, { data: {} }]] });
  const r = await run(["delete", "vc1"]);
  assert.deepEqual(r, { code: 0, out: "", err: "" });
});

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · audio/scripts/heygen-voice.test.mjs (reported line 229)May include surrounding context.

js
});

test("delete calls DELETE /voices/<id> and exits 0", async () => {
  mockFetch({ "DELETE /voices/vc1": [[200, { data: {} }]] });
  const r = await run(["delete", "vc1"]);
  assert.deepEqual(r, { code: 0, out: "", err: "" });
});

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · audio/scripts/heygen-voice.test.mjs (reported line 148)May include surrounding context.

js
});

test("delete exits 0 on a 204 with no body, and escapes the id in the path", async () => {
  mockFetch({ "DELETE /voices/a%2Fb": [[204]] });
  const r = await run(["delete", "a/b"]);
  assert.deepEqual(r, { code: 0, out: "", err: "" });
});

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · audio/scripts/heygen-voice.test.mjs (reported line 181)May include surrounding context.

js
test("delete prints HeyGen's 404 message verbatim and exits 1", async () => {
  mockFetch({
    "DELETE /voices/gone": [
      [404, { error: { code: "voice_not_found", message: "Voice not found: gone" } }],
    ],
  });

Credential Access

High
Category
Privilege Escalation
Confidence
81% confidence
Finding

The module intentionally searches multiple local credential sources, including a nearby project .env and ~/.heygen/credentials, then uses those secrets to authenticate outbound requests. In a skill/plugin context, this broad credential discovery increases the blast radius: an untrusted project directory can influence which secrets are loaded, and the skill gains access to tokens beyond explicit user input.

Content

Scanner excerpt · audio/scripts/lib/heygen.mjs (reported line 6)May include surrounding context.

js
// pipeline. The credential resolver matches the hyperframes CLI auth: first
// usable source wins — a host gateway ($HEYGEN_API_BASE with its own
// $HEYGEN_API_KEY) → a host-injected OAuth $HEYGEN_ACCESS_TOKEN (Bearer) →
// $HEYGEN_API_KEY / $HYPERFRAMES_API_KEY → a nearby .env → ~/.heygen/
// credentials (oauth → Bearer, else api_key → X-Api-Key; $HEYGEN_CONFIG_DIR
// overrides the dir). $HEYGEN_API_BASE moves every request to that host, as it
// does for the heygen CLI; plain HTTP needs $HEYGEN_ALLOW_HTTP=1, as there.

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

The comment correctly acknowledges the core risk: if a project-controlled .env could set HEYGEN_API_BASE, it might redirect the user's shell HEYGEN_API_KEY to an attacker-controlled host. The code mitigates this for HEYGEN_API_BASE and HEYGEN_ALLOW_HTTP, but the surrounding design still trusts nearby .env files for other credentials, which is dangerous in an agent skill that may run inside untrusted repositories.

Content

Scanner excerpt · audio/scripts/lib/heygen.mjs (reported line 67)May include surrounding context.

js
}
}

// A host app sets these in the environment it spawns, never in a project file: a project's .env naming its own base
// would send the person's shell HEYGEN_API_KEY to that host.
const HOST_ONLY = new Set(["HEYGEN_API_BASE", "HEYGEN_ALLOW_HTTP"]);

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

loadEnvFromDir walks up to five parent directories and imports the first .env it finds into process.env. In an agent/skill setting, that enables a repository or parent folder controlled by someone else to inject API credentials or alter authentication behavior for subsequent network calls, creating a secret-confusion and unintended-secret-use risk.

Content

Scanner excerpt · audio/scripts/lib/heygen.mjs (reported line 71)May include surrounding context.

js
// would send the person's shell HEYGEN_API_KEY to that host.
const HOST_ONLY = new Set(["HEYGEN_API_BASE", "HEYGEN_ALLOW_HTTP"]);

// Walk up ≤5 dirs from startDir; load the first .env (shell env always wins).
export function loadEnvFromDir(startDir) {
  let dir = resolve(startDir);
  for (let i = 0; i < 5; i++) {

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

Reading .env from the current or ancestor directories is the concrete mechanism that makes the prior risk exploitable. In the skill context, where content may be adversarial and repositories may be untrusted, automatic ancestor traversal can cause hidden credential injection without the operator noticing.

Content

Scanner excerpt · audio/scripts/lib/heygen.mjs (reported line 75)May include surrounding context.

js
export function loadEnvFromDir(startDir) {
  let dir = resolve(startDir);
  for (let i = 0; i < 5; i++) {
    const text = envFileText(join(dir, ".env"));
    if (text != null) {
      for (const raw of text.split("\n")) {
        let line = raw.trim();

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · audio/scripts/lib/heygen.test.mjs (reported line 138)May include surrounding context.

js
});
});

test("loadEnvFromDir skips a .env folder and loads the .env file above it", () => {
  const root = mkdtempSync(join(tmpdir(), "heygen-env-"));
  const project = join(root, "project");
  mkdirSync(join(project, ".env"), { recursive: true });

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · audio/scripts/lib/heygen.test.mjs (reported line 152)May include surrounding context.

js
});
});

test("loadEnvFromDir skips a .env folder and loads the .env file above it", () => {
  const root = mkdtempSync(join(tmpdir(), "heygen-env-"));
  const project = join(root, "project");
  mkdirSync(join(project, ".env"), { recursive: true });

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · scripts/audio-duck.mjs (reported line 91)May include surrounding context.

js
return;
  }

  console.log(`<!-- auto-duck: ${target} under narration; add to its <audio> element -->`);
  console.log(`data-automation='${JSON.stringify(lane)}'`);
}

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes shell commands, accesses environment-controlled behavior, performs network-backed provider operations, and writes media/ledger artifacts, yet it declares no explicit tool scope or permission boundary. That increases the chance the agent can execute broader actions than a host or reviewer expects, especially because this skill is designed to fetch remote assets, authenticate to providers, and persist files.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Using npx hyperframes without a pinned version allows the package resolved at runtime to change over time, introducing supply-chain risk. A compromised or newly published version could execute arbitrary code during install or command execution in the agent's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This is another unpinned npx hyperframes invocation, carrying the same runtime package substitution and supply-chain exposure. Because the skill encourages first-run setup and diagnostic execution, users may run it in privileged environments where a malicious package would have access to files, tokens, and network.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
Surface an opportunity only when a concrete signal is present:

| Signal detected                                          | Offer                                                                                                  |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| On-screen text / a script with no voiceover              | TTS voiceover (audio engine)                                                                           |
| Emoji or a `<div>` styled as an icon                     | resolve real `icon`s                                                                                   |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md
Surface an opportunity only when a concrete signal is present:

| Signal detected                                          | Offer                                                                                                  |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| On-screen text / a script with no voiceover              | TTS voiceover (audio engine)                                                                           |
| Emoji or a `<div>` styled as an icon                     | resolve real `icon`s                                                                                   |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md
| Signal detected                                          | Offer                                                                                                  |
| -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
| On-screen text / a script with no voiceover              | TTS voiceover (audio engine)                                                                           |
| Emoji or a `<div>` styled as an icon                     | resolve real `icon`s                                                                                   |
| Image that is a placeholder, tiny, or upscaled-looking   | a better `image` (and/or upscale — see `references/operations.md`)                                     |
| Hard scene cuts / transitions with no sound              | transition `sfx`                                                                                       |
| A piece over ~10s with no music bed                      | `bgm`                                                                                                  |

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.env_credential_access (+1 more)

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
audio/scripts/audio.test.mjs:141

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
audio/scripts/gemini-pipeline.test.mjs:78

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
audio/scripts/heygen-tts.test.mjs:17

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
audio/scripts/lib/audio-meta.test.mjs:110

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
audio/scripts/lib/bgm.mjs:35

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
audio/scripts/lib/gemini-auth.test.mjs:84

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
audio/scripts/lib/python.mjs:7

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
audio/scripts/lib/tts.cleanup.test.mjs:129

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
audio/scripts/lib/tts.mjs:33

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
audio/scripts/lib/tts.spawn.test.mjs:12

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
audio/scripts/wait-bgm.test.mjs:87

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/compatibility.test.mjs:12

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/dither.test.mjs:24

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/eval.mjs:43

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/lib/npx-sync.mjs:20

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/resolve-plugin.test.mjs:24

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/resolve.mjs:16

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/transcribe.mjs:111

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/transcribe.test.mjs:28

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/transcript-cut.mjs:215

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/transcript-cut.test.mjs:28

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
audio/scripts/lib/gemini-auth_test.py:21

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
audio/scripts/lib/heygen.mjs:22

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
audio/scripts/lib/gemini-auth.test.mjs:53

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
audio/scripts/lib/gemini-tts.test.mjs:191

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/lib/telemetry.mjs:12