ClawHub
Back to skill

Security audit

video-to-screenplay

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: converts user-provided audio, video, or transcripts into screenplay files using transcription and selected external LLM providers.

Install and run this only on transcripts or media you are comfortable sending to the selected LLM provider, and use a dedicated virtual environment because the dependency install is unpinned. Be aware the current script also contains a Python syntax error in the Google-provider URL branch that should be fixed before use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:29
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:29
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash
pip install faster-whisper

Technical Analysis

The installation command does not pin faster-whisper to a reviewed version and does not verify package integrity using cryptographic hashes. It therefore installs whichever release and transitive dependencies the package index resolves at installation time.

This makes the effective dependency code mutable after the Skill has been audited. If the upstream package, maintainer account, distribution channel, or a transitive dependency is compromised, a user following the documented command may install attacker-controlled code. Python packages may execute build hooks during installation and arbitrary code when subsequently imported by the audio workflow.

The issue is limited to the documented dependency installation process. The audited Skill does not itself retrieve and execute a remote script, and exploitation requires the user to follow the installation instruction while a malicious or compromised package version is available.

Attack Path

  1. An attacker compromises the upstream package, its publishing credentials, or one of its unresolved transitive dependencies.
  2. The attacker publishes a malicious release that remains compatible with the unpinned package name.
  3. A user follows the Skill documentation and runs pip install faster-whisper.
  4. Package resolution selects the malicious release or dependency because no approved version or hash is enforced.
  5. Attacker-controlled code executes through package installation hooks or when video_to_screenplay.py imports faster_whisper for the --audio workflow.
  6. The malicious code operates with the privileges of the user running pip or the Skill.

Impact Assessment

Successful exploitation could provide arbitrary code execution w ...[truncated 558 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin faster-whisper and every transitive dependency to reviewed versions in a lock file.
  2. Record and enforce package hashes using a requirements file, for example:
    bash
    pip install --require-hashes -r requirements.txt
  3. Generate the lock file from a trusted package index and review dependency updates before changing pinned versions or hashes.
  4. Explicitly specify the official package index and disable unintended additional indexes to reduce dependency-confusion exposure.
  5. Install dependencies inside an isolated virtual environment with no administrative privileges.
  6. Consider using pre-reviewed wheels and disabling source builds where operationally feasible to reduce exposure to build-time execution.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises and instructs use of capabilities that imply local file access and outbound network use, but it does not declare any tool scope or permissions boundary. That omission can mislead users and hosting agents about what the skill may access or transmit, reducing transparency and increasing the chance of over-privileged execution or unintended data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill processes transcripts and extracted story data through third-party LLM providers, but the description does not clearly warn users that potentially sensitive content will be sent off-box to external services. In this context, transcripts may contain private conversations, proprietary media, or personal data, so lack of disclosure creates a real confidentiality and consent risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/video_to_screenplay.py (reported line 35)May include surrounding context.

python
os.path.expanduser("~/AppData/Roaming/openclaw/openclaw.json"),
]
PROVIDERS = {
    "deepseek": ("https://api.deepseek.com/v1", "openai-completions"),
    "kimi":     ("https://api.moonshot.cn/v1", "openai-completions"),
    "zhipu":    ("https://open.bigmodel.cn/api/paas/v4", "openai-completions"),
    "longcat":  ("https://api.longcat.chat/openai/v1", "openai-completions"),

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/video_to_screenplay.py (reported line 36)May include surrounding context.

python
]
PROVIDERS = {
    "deepseek": ("https://api.deepseek.com/v1", "openai-completions"),
    "kimi":     ("https://api.moonshot.cn/v1", "openai-completions"),
    "zhipu":    ("https://open.bigmodel.cn/api/paas/v4", "openai-completions"),
    "longcat":  ("https://api.longcat.chat/openai/v1", "openai-completions"),
    "google":   ("https://generativelanguage.googleapis.com/v1beta", "google-generative-ai"),

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/video_to_screenplay.py (reported line 38)May include surrounding context.

python
"deepseek": ("https://api.deepseek.com/v1", "openai-completions"),
    "kimi":     ("https://api.moonshot.cn/v1", "openai-completions"),
    "zhipu":    ("https://open.bigmodel.cn/api/paas/v4", "openai-completions"),
    "longcat":  ("https://api.longcat.chat/openai/v1", "openai-completions"),
    "google":   ("https://generativelanguage.googleapis.com/v1beta", "google-generative-ai"),
    "agnes":    ("https://apihub.agnes-ai.com/v1", "openai-completions"),
}

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The system and prompt text explicitly require screenplay generation in Traditional Chinese, and the transcription path also hard-codes Chinese language handling. This is a natural-language policy concern because the skill imposes a specific language/locale without user opt-in or a documented justification.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code persists the full transcript to disk and forwards transcript content to external LLM providers verbatim. This increases exposure of potentially sensitive audio-derived content both locally and over the network, especially if the input contains personal, confidential, or regulated data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script sends transcript-derived content and story DNA to third-party LLM APIs without any explicit consent flow, warning, or data minimization step. Because transcripts may contain sensitive spoken information, this creates a real confidentiality risk through external disclosure that users may not reasonably expect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The usage example hard-codes the genre argument to the Chinese term "科幻" without explaining that language is configurable or offering a user choice. This can be read as steering outputs toward a specific language/locale in a way that is not documented or opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.