ClawHub
Back to skill

Security audit

second-brain

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent as a personal knowledge ingester, but it automatically fetches and processes remote content, persists personal notes locally, and overstates its implemented safety screening.

Review before installing. Use this skill only if you are comfortable with it saving provided notes and URLs locally, fetching article/video content, and running yt-dlp and ffmpeg. Avoid giving it sensitive private links or personal data unless you have constrained its storage and network behavior. Do not rely on the advertised Step 2.5 screening unless the referenced processor is corrected or independently verified.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
video_file = frame_dir / "video.mp4"
    try:
        subprocess.run([
            ytdlp, "--", url,  # positional isolation prevents option injection
            "--format", "bestvideo[height<=720][ext=mp4]+bestaudio[ext=m4a]/best[height<=720][ext=mp4]/best[height<=720]",
            "--output", str(video_file),
Confidence
92% confidence
Finding
The code passes a user-influenced URL into an external downloader, causing the skill to fetch arbitrary remote content and process it locally. Although shell injection is mitigated by using an argument list and `--`, this still expands the attack surface to SSRF-like outbound access, retrieval of untrusted media, and exposure to vulnerabilities in `yt-dlp` or downstream codecs.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# Extract 6 evenly spaced frames
    frames = []
    try:
        result = subprocess.run([
            ffmpeg_path, "-i", str(video_file),
            "-vf", "fps=1/10,scale=640:-1",
            "-frames:v", "6",
Confidence
89% confidence
Finding
The script feeds attacker-controlled downloaded media into `ffmpeg`, a complex parser with a long history of media-handling bugs. Even without command injection, processing untrusted video can trigger denial of service or exploitation in the external binary if a crafted file is supplied.

Lp3

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding
The skill describes capabilities that read and write local files, access the network, and invoke shell commands, but it does not declare permissions or present explicit execution boundaries. This creates a transparency and governance gap: users and platforms cannot reliably assess or constrain what the skill may do before activation.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The invocation scope is broad enough that ordinary links or free-form notes may automatically trigger fetching, analysis, storage, and shell-backed media processing. Overbroad auto-trigger behavior increases the chance of unintended handling of sensitive data or processing attacker-controlled content without clear user intent.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill persistently stores personal notes, fetched content summaries, metadata, and possible safety annotations, but it does not clearly warn users about retention, storage location, or lifecycle. This can lead to accidental collection of sensitive personal or third-party data and increases privacy and compliance risk.

Missing User Warnings

Medium
Confidence
79% confidence
Finding
The skill accepts arbitrary input, auto-detects video URLs, and then performs outbound network retrieval and local media processing without any explicit consent or strong trust boundary checks. In an agent context, this can be abused for SSRF-like access attempts, unexpected egress to attacker-controlled infrastructure, privacy leakage through URL fetching, and resource consumption by making the agent contact untrusted remote content.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
- **Path Traversal Shield:** All entry filenames and media directories enforce strict UUID resolution and boundary checks against `ENTRIES_DIR` and `MEDIA_DIR`.
- **Command Isolation:** `yt-dlp` invocations utilize `--` positional argument isolation to prevent command-line option injection attacks.
- **File Permissions:** Entry files (`.json`) and master indices (`index.json`) are stored with strict `0600` file permissions.
- **Atomic Persistence:** Write operations to `index.json` use atomic temp-file replace patterns to guarantee index integrity under concurrent access.
Confidence
84% confidence
Finding
The skill combines filesystem access, network retrieval, and shell execution through external tools, which is a materially powerful capability set. Even with documented safeguards, unrestricted or weakly scoped tool access enlarges the blast radius if the skill processes malicious URLs, hostile content, or ambiguous user input.

Static analysis

No suspicious patterns detected.