ClawHub
Back to skill

Security audit

AI科普视频工作室（Mac mini 16G适用）

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent AI video-production workflow, but it needs review because it uses sensitive voice/image/account workflows and can automatically install an unpinned Python package at runtime.

Install only after reviewing the account and dependency risks. Use a dedicated Chrome profile or separate Google account for Flow, process only voice and portrait data you have rights to use, run the scripts in an isolated environment, and preinstall pinned dependencies instead of allowing runtime pip installation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/render_subtitles.py:73
Finding

Automatic Installation and Immediate Execution of an Unpinned Dependency

Content
View full analysis

Vulnerability Details

File Location: scripts/render_subtitles.py, lines 73–79
Vulnerability Type: Unpinned runtime dependency installation
Risk Level: Medium

Vulnerable Code

python
try:
    import whisper
except ImportError:
    print("Installing openai-whisper...")
    subprocess.run([sys.executable, "-m", "pip", "install", "openai-whisper"],
                   check=True)
    import whisper

Technical Analysis

When the whisper module is unavailable, the subtitle transcription workflow automatically invokes pip to install openai-whisper. The dependency has no pinned version or integrity hash, and the code does not constrain the package index to an approved source. The resulting package is imported immediately in the same privileged process.

This creates a supply-chain execution boundary: the effective code executed by the Skill can change after the Skill itself has been audited. Package selection may also be influenced by the active pip configuration, environment variables, proxy settings, or configured private indexes.

The argument-array invocation avoids shell injection, but it does not mitigate dependency substitution or repository compromise.

Attack Path

  1. An attacker compromises a selected openai-whisper release, one of its transitive dependencies, or a package index configured in the execution environment.
  2. A user runs the transcribe command on a system where the whisper module is not installed.
  3. The ImportError handler launches python -m pip install openai-whisper.
  4. Pip resolves and installs attacker-controlled package code without version or hash verification.
  5. Package installation hooks may execute during installation.
  6. The script immediately imports whisper, executing its module initialization code with the privileges of the user running the Skill.

Impact Assessment

Successful exploitation could execute arbitrary code with the invoking user’s privileges. Depending on that a ...[truncated 420 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove automatic package installation from application runtime. If whisper is unavailable, terminate with a clear dependency-installation message.
  2. Declare openai-whisper and all dependencies in a version-controlled dependency manifest and lockfile.
  3. Pin exact versions and require cryptographic hashes, such as through a hash-locked requirements file and pip install --require-hashes.
  4. Restrict installation to an explicitly approved package index and review pip configuration in build environments.
  5. Install dependencies during a controlled build or setup phase rather than while processing user media.
  6. Scan and audit direct and transitive dependencies before deployment.
  7. Run transcription in a sandbox or container with least privilege, restricted filesystem access, and only necessary network access.
  8. Separate dependency installation from package import so newly installed code is not executed automatically without verification or explicit user approval.

A safer failure pattern is:

python
try:
    import whisper
except ImportError as exc:
    raise SystemExit(
        "Missing dependency: install the audited, pinned Whisper environment "
        "before running transcription."
    ) from exc

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description promises a comprehensive automated AI video production workflow spanning multiple creation and post-production stages. The actual code chunk only performs one limited function: audio quality analysis on an input media file. While QA is mentioned in the declared description, this code does not implement the broader pipeline and therefore does not accurately represent the declared overall capability. There are no suspicious undeclared permissions or external resource accesses beyond invoking ffmpeg on a local file, but the primary purpose is materially narrower and different from the declared end-to-end video creation skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill describes shell, file read, and file write capabilities but does not declare any explicit tool scope or permission boundaries. In an agent environment, this increases the chance of over-broad execution, unintended file access, or shell invocation beyond what users expect, especially because the workflow includes FFmpeg, Python scripts, and local file manipulation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill promotes personal voice cloning but does not require explicit consent, ownership verification, or retention limits for reference voice data. That omission can enable impersonation, non-consensual biometric processing, and unauthorized reuse of sensitive voice samples, which is particularly risky because voice data is uniquely identifying and hard to revoke once exposed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs uploading a portrait photo to an external service without clearly warning the user that biometric or personally identifying image data will be transferred off-device. This can lead to unintended disclosure of facial data, third-party processing under external terms, and privacy harm if users assume the workflow is local-only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Referencing the user's Google account credentials via a Chrome profile without a strong warning and isolation guidance creates account-access and session-security risk. In an agent-driven workflow, using an already-authenticated browser profile can expose email, cloud files, payment-linked services, or other account data well beyond the narrow task of video generation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Line L104 hard-codes --language zh in the Whisper verification command, and the surrounding checklist also assumes Chinese-specific pronunciation review. This imposes a specific language/locale workflow without user opt-in or an explicit justification that the skill is only for Chinese-language content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The section beginning at L132 states 'All Chinese pronunciation is correct and natural' and provides a Chinese-specific correction mapping, but the document does not clearly declare that it applies only to Chinese-language productions. That creates a natural-language locale policy issue because it hardwires one language expectation without clearly scoped applicability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown specification uses Chinese as the default content language in the schema examples and later reinforces Chinese-specific narration rules, but it does not state that language selection is optional. That creates a natural-language policy concern because the skill appears to force a specific language/locale without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The narration rules prescribe Chinese-specific timing guidance ('For Chinese') as part of the core writing instructions, which signals a default locale constraint. Because the document does not offer alternative language handling or explain why the skill must be Chinese-specific, this is a policy-style language restriction issue.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/audio_analyzer.py (reported line 25)May include surrounding context.

python
def extract_audio_wav(video_path, output_path):
    """Extract audio as 16-bit PCM WAV for analysis."""
    subprocess.run([
        "ffmpeg", "-y",
        "-i", video_path,
        "-vn",

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compose_final.py (reported line 45)May include surrounding context.

python
"-of", "json",
        video_path,
    ]
    result = subprocess.run(cmd, capture_output=True, text=True, check=True)
    data = json.loads(result.stdout)
    return float(data["format"]["duration"])

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compose_final.py (reported line 61)May include surrounding context.

python
if total_frames == 0:
        print(f"Warning: No subtitle frames in {subtitle_frame_dir}, skipping overlay")
        # Just copy
        subprocess.run(["ffmpeg", "-y", "-i", video_path, "-c", "copy", output_path],
                       check=True)
        return

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compose_final.py (reported line 83)May include surrounding context.

python
"-shortest",
        output_path,
    ]
    subprocess.run(cmd, check=True)
    print(f"  Subtitled: {video_path} → {output_path}")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compose_final.py (reported line 128)May include surrounding context.

python
with tempfile.TemporaryDirectory() as tmpdir:
        for i, seg in enumerate(segment_paths):
            tmp_path = os.path.join(tmpdir, f"u_{i:02d}.mp4")
            subprocess.run([
                "ffmpeg", "-y", "-i", seg,
                "-c:v", "libx264", "-crf", "20",
                "-c:a", "aac", "-ar", "48000", "-ac", "2", "-b:a", "192k",

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
91% confidence
Finding

The concat demuxer is invoked with -safe 0, and the concat file is generated from paths ultimately influenced by input segment paths. Disabling ffmpeg's safety checks increases the risk of processing unexpected path forms or special file locations if untrusted paths are allowed into the pipeline, which can expand file access and facilitate denial of service or unintended file reads by ffmpeg.

Content

Scanner excerpt · scripts/compose_final.py (reported line 144)May include surrounding context.

python
for u in unified:
                f.write(f"file '{u}'\n")

        subprocess.run([
            "ffmpeg", "-y",
            "-f", "concat", "-safe", "0",
            "-i", concat_path,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

This call passes a dynamically constructed ffmpeg filter graph containing unvalidated values derived from input media count and the user-controlled xfade duration. While it does not invoke a shell, malformed or extreme values can cause ffmpeg to fail, consume excessive resources, or behave unpredictably during complex filter processing, making this a denial-of-service risk in an automation pipeline that may process external inputs.

Content

Scanner excerpt · scripts/compose_final.py (reported line 202)May include surrounding context.

python
output_path,
    ])

    subprocess.run(cmd, check=True)
    print(f"Composited {len(segment_paths)} segments with {xfade}s xfade → {output_path}")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_slides.py (reported line 93)May include surrounding context.

python
output_path,
    ]

    proc = subprocess.Popen(ffmpeg_cmd, stdin=subprocess.PIPE)

    # Calculate reveal timing
    non_empty_lines = [l for l in lines if l.strip()]

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The transcribe function hard-codes language="zh" as the default, which imposes a specific language/locale behavior unless the user explicitly overrides it. This is a natural-language policy concern because the script prefers one language by default rather than prompting for or auto-detecting the user's language choice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Installing Python packages during execution is dangerous because it turns a content-processing script into a network-dependent code acquisition path. In a media automation skill that may run unattended, this increases exposure to dependency confusion, typosquatting, malicious upstream releases, or environment tampering.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The script automatically invokes pip to install a package at runtime when an import fails. This creates a software supply-chain risk because execution depends on live package resolution and installation during normal operation, which can introduce unreviewed code into the environment and unexpectedly modify the host system.

Content

Scanner excerpt · scripts/render_subtitles.py (reported line 77)May include surrounding context.

python
import whisper
    except ImportError:
        print("Installing openai-whisper...")
        subprocess.run([sys.executable, "-m", "pip", "install", "openai-whisper"],
                       check=True)
        import whisper

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The command-line interface sets --language to default to zh, which means users who do not notice or understand the option will get Chinese-language transcription behavior by default. This creates a locale-specific default without explicit opt-in or clear justification.

Content

No source excerpt is available for this finding.