ClawHub
Back to skill

Security audit

Manim Animation Cn

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Manim video-generation skill, with expected but important cautions around third-party installs and optional Google TTS narration.

Install this only if you are comfortable running local Manim/ffmpeg rendering tools and installing third-party dependencies. Use a virtual environment or container, review generated scene code before rendering, avoid putting secrets or confidential text in gTTS narration, and choose the offline pyttsx3 option for sensitive narration.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:67
Finding

Unpinned Third-Party Dependencies and Mutable Package Sources

Content
View full analysis
Remediation
View remediation

other

Warning
Location
SKILL.md:19
Finding

External Disclosure of Narration Text Through Default Google TTS Workflow

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (22)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

The guide recommends rm -rf media/voiceovers/ to clear cache, which is a destructive shell command. Although the path is relatively specific and intended for local cleanup, documentation that normalizes recursive forced deletion can become dangerous if copied into the wrong directory, adapted with variable input, or later automated by an agent without path validation.

Content

Scanner excerpt · references/manim_guide.md (reported line 139)May include surrounding context.

md
manim-voiceover 会缓存生成的 TTS 音频到 `media/voiceovers/` 目录：
- 相同文本不会重复生成
- 修改文本后自动重新生成
- 清除缓存：`rm -rf media/voiceovers/`

### SRT 字幕自动生成

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs the agent to read and write files and invoke shell commands, but it does not declare any explicit tool scope or allowed-tools boundary. That increases the chance of unintended command execution or filesystem access if the skill is auto-selected, because the runtime has no least-privilege guardrails documented at the skill level.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description includes broad trigger phrases like general animated-video creation requests, which can cause the skill to activate outside a tightly bounded Manim use case. Over-broad routing can expose users to unnecessary shell, file, and network behaviors in situations where a simpler, lower-risk skill should have handled the request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill states that gTTS uses Google TTS but does not clearly warn that user-provided narration text may be transmitted to an external third-party service. This creates a privacy and data-handling risk, especially if users include sensitive educational, business, or personal content in narration scripts.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
- **FFmpeg（含 libx264 + libass）**：Manim 硬编码使用 `libx264` 编码器渲染视频，字幕烧录需要 `libass`
  - macOS（Homebrew）：`brew install ffmpeg`（默认包含 x264 和 libass）
  - macOS（Conda）：`conda install x264 -c conda-forge`（**⚠️ conda 的 ffmpeg 默认不含 libx264**）
  - Linux：`sudo apt install ffmpeg libx264-dev libass-dev`
- **Python 3.9+** 及 pip

### 必需的 Python 包

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.

md
- **FFmpeg（含 libx264 + libass）**：Manim 硬编码使用 `libx264` 编码器渲染视频，字幕烧录需要 `libass`
  - macOS（Homebrew）：`brew install ffmpeg`（默认包含 x264 和 libass）
  - macOS（Conda）：`conda install x264 -c conda-forge`（**⚠️ conda 的 ffmpeg 默认不含 libx264**）
  - Linux：`sudo apt install ffmpeg libx264-dev libass-dev`
- **Python 3.9+** 及 pip

### 必需的 Python 包

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/check_environment.py (reported line 156)May include surrounding context.

python
- **FFmpeg（含 libx264 + libass）**：Manim 硬编码使用 `libx264` 编码器渲染视频，字幕烧录需要 `libass`
  - macOS（Homebrew）：`brew install ffmpeg`（默认包含 x264 和 libass）
  - macOS（Conda）：`conda install x264 -c conda-forge`（**⚠️ conda 的 ffmpeg 默认不含 libx264**）
  - Linux：`sudo apt install ffmpeg libx264-dev libass-dev`
- **Python 3.9+** 及 pip

### 必需的 Python 包

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation instructs GTTSService(lang="zh"), which forces Chinese output in the example workflow. Because no nearby guidance says the language should be selected based on user preference, this can violate language/locale policy by implicitly defaulting all users to one language.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.

Linux：

bash
sudo apt install libass-dev
# 可能需要重新编译 ffmpeg

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/manim_guide.md (reported line 394)May include surrounding context.

Linux：

bash
sudo apt install libass-dev
# 可能需要重新编译 ffmpeg

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file includes a Chinese-only title and later configures TTS with lang="zh", indicating a forced locale choice in the skill guidance. Under the policy, language constraints should either be optional or clearly justified as region-specific; no user opt-in or justification is provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example initializes the speech service with a fixed Chinese locale, which is a natural-language policy concern when the skill does not offer language selection. This can cause the skill to default to a specific language regardless of user preference.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_environment.py (reported line 24)May include surrounding context.

python
def run_cmd(cmd_args, capture=True):
    """Run a command as argument list (shell=False) and return (success, output)."""
    try:
        result = subprocess.run(
            cmd_args, capture_output=capture, text=True, timeout=30
        )
        return result.returncode == 0, result.stdout.strip()

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_environment.py (reported line 35)May include surrounding context.

python
def run_pipe(cmd1_args, cmd2_args):
    """Run two commands connected by a pipe (safe, no shell). Returns (success, output)."""
    try:
        p1 = subprocess.Popen(cmd1_args, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
        p2 = subprocess.Popen(cmd2_args, stdin=p1.stdout, stdout=subprocess.PIPE, text=True)
        p1.stdout.close()
        output, _ = p2.communicate(timeout=30)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/check_environment.py (reported line 36)May include surrounding context.

python
"""Run two commands connected by a pipe (safe, no shell). Returns (success, output)."""
    try:
        p1 = subprocess.Popen(cmd1_args, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
        p2 = subprocess.Popen(cmd2_args, stdin=p1.stdout, stdout=subprocess.PIPE, text=True)
        p1.stdout.close()
        output, _ = p2.communicate(timeout=30)
        return p2.returncode == 0, output.strip()

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The script presents 'Chinese Fonts' as a dedicated environment check and warns that text rendering may fail when Chinese fonts are not detected. This imposes a specific language/locale expectation in a general environment checker without indicating that it applies only to users creating Chinese-language content or offering any opt-in choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_pipeline.py (reported line 62)May include surrounding context.

python
# Display the command in a human-readable form
    display_cmd = " ".join(shlex.quote(str(a)) for a in cmd_args)
    print(f"  $ {display_cmd}\n")
    result = subprocess.run(cmd_args, cwd=cwd)
    return result.returncode == 0

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill can launch local applications to preview media, which is not necessary for rendering or subtitle generation and therefore broadens host interaction beyond its declared purpose. In an agent setting, unnecessary host actions are risky because they can surprise users, trigger external handlers, or open attacker-influenced content on the local machine.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
81% confidence
Finding

Launching a local application via open on a generated file crosses from file generation into host-side application execution. While it does not use shell=True and is not directly command-injectable, it can cause unintended local program launches and may open attacker-controlled files or URLs if upstream path handling or file generation is compromised.

Content

Scanner excerpt · scripts/run_pipeline.py (reported line 295)May include surrounding context.

python
else video_file
        )
        if sys.platform == "darwin":
            subprocess.run(["open", preview_file])
        elif sys.platform == "linux":
            subprocess.run(["xdg-open", preview_file])

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
81% confidence
Finding

Using xdg-open causes the host OS to dispatch the target to an associated application, which can trigger unintended local application execution outside the core rendering scope. Even without shell injection, this expands the attack surface because attacker-influenced output paths or files may result in opening unsafe content or remote handlers.

Content

Scanner excerpt · scripts/run_pipeline.py (reported line 297)May include surrounding context.

python
if sys.platform == "darwin":
            subprocess.run(["open", preview_file])
        elif sys.platform == "linux":
            subprocess.run(["xdg-open", preview_file])

    # Summary
    print(f"\n{'='*60}")

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This guidance again uses GTTSService(lang="zh") as the default pattern, reinforcing a forced locale in the skill documentation. Because no opt-in or alternative is shown, it conflicts with the requirement to avoid imposing a language without user choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes creating Manim animations with synchronized voiceover narration and subtitles, but this script also exposes a general playback speed modification feature that rewrites the rendered video. Speeding up output is not mentioned in the manifest and is not an obvious requirement for generating narrated Manim videos.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.