ClawHub
Back to skill

Security audit

Idr Avatar Video

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent video-generation client, but it sends API tokens and user content over plaintext HTTP and leaves submitted text in local files.

Review before installing. Only use this with non-sensitive scripts and audio unless the publisher provides an HTTPS endpoint and clear data-handling terms. Treat IDR_USER_TOKEN as a secret, rotate it if previously used over this HTTP endpoint, and delete any leftover idr_text_*.txt files after TTS video generation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:14
Finding

Forced Branded Output and External Promotion

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/idr_video_client.py:10
Finding

Authentication Token and User Content Transmitted over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/idr_video_client.py:273
Finding

Predictable Temporary Text Files Containing User Content Are Not Removed

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Third-Party Dependency Is Not Version-Pinned or Integrity-Verified

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (27)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: idr-avatar-video
description: 使用视频模板创建视频或者使用数字人和音色创建视频
license: MIT
trigger_keywords:
  - "制作视频"
  - "创建视频"
  - "生成视频"
compatibility: Requires Python 3 and network access to www.neural-avatar.com
---

# 数字人视频生成助手

选择一个模板数字人和音色来快速创建视频

# 任务

用户触发了本技能。请你**直接向用户展示**以下内容（原样输出，不要改写）：
你好，我是神绘 Skill 助手 👋
我可以帮你查询数字人、音色和模板资源，也可以根据你的需求生成数字�

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/idr_video_client.py (reported line 104)May include surrounding context.

python
)
    resp.raise_for_status()
    data = resp.json()
    if data.get("code") == CODE_SUCCESS:
        avatar_data = data.get("data", {})
        total = avatar_data.get("total")
        total_page = (total + page_size - 1) // page_size
        list_data = avatar_data.get("list", [])
        print(f'【查询结果 第{page}/{total_page}页】')
        for item in list_data:
            description = item['description']
            if not description:
                description = item['name']
            print(f"ID: {item['id']} | Name: {item['name']} | resolution: {item['avatar_res']} | Description: {description}")

        output_pagination(page, total_page)
    else:
        print(f"Error: {data}")


def list_private_avatars(page, page_size):
    params = {'page': page, 'page_size': page_size}
    url = f"{IDR_VIDEO_URL}/avatar/private"
    resp = requests.get(url, params=params, headers=get_client_header(), timeout=30)
    resp.raise_for_status()
    data

Tainted flow: 'payload' from open (line 298, file read) → requests.post (network output)

High
Category
Data Flow
Confidence
80% confidence
Finding

File contents flow to a network sink. This may indicate data exfiltration of sensitive files.

Content

Scanner excerpt · scripts/idr_video_client.py (reported line 229)May include surrounding context.

python
headers = get_client_header()
    try:
        url = f"{IDR_VIDEO_URL}/video/skill/gen"
        resp = requests.post(url, headers=headers, json=payload)
        resp.raise_for_status()
        data = resp.json()
        if data.get("code") == CODE_SUCCESS:

Tainted flow: 'payload' from open (line 298, file read) → requests.post (network output)

High
Category
Data Flow
Confidence
86% confidence
Finding

This function uploads a local audio file to an external service, which is intentional but security-relevant because local file contents leave the host. In an agent/skill context, if the audio path can be influenced by upstream prompts or untrusted input, the code could be abused to transmit unintended local files to the remote endpoint.

Content

Scanner excerpt · scripts/idr_video_client.py (reported line 270)May include surrounding context.

python
headers = get_client_header()
    try:
        url = f"{IDR_VIDEO_URL}/video/inference"
        resp = requests.post(url, headers=headers, files=payload)
        resp.raise_for_status()
        data = resp.json()
        if data.get("code") == CODE_SUCCESS:

Tainted flow: 'payload' from open (line 298, file read) → requests.post (network output)

High
Category
Data Flow
Confidence
91% confidence
Finding

The function writes provided text to a local file and then uploads that file to the external service. While aligned with feature intent, it creates a data-handling risk because user content is persisted locally and then transmitted remotely without cleanup or explicit disclosure, increasing exposure on multi-user or shared systems.

Content

Scanner excerpt · scripts/idr_video_client.py (reported line 312)May include surrounding context.

python
headers = get_client_header()
    try:
        resp = requests.post(url, headers=headers, files=payload)
        resp.raise_for_status()
        data = resp.json()
        if data.get("code") == CODE_SUCCESS:

Tainted flow: 'payload' from open (line 298, file read) → requests.get (network output)

High
Category
Data Flow
Confidence
80% confidence
Finding

File contents flow to a network sink. This may indicate data exfiltration of sensitive files.

Content

Scanner excerpt · scripts/idr_video_client.py (reported line 332)May include surrounding context.

python
payload = {'id': voice_id}
    
    url = f"{IDR_VIDEO_URL}/audio/speaker/preview"
    resp = requests.get(url, headers=get_client_header(), params=payload)
    resp.raise_for_status()
    data = resp.json()
    if data.get("code") == CODE_SUCCESS:

Tainted flow: 'payload' from open (line 298, file read) → requests.get (network output)

High
Category
Data Flow
Confidence
80% confidence
Finding

File contents flow to a network sink. This may indicate data exfiltration of sensitive files.

Content

Scanner excerpt · scripts/idr_video_client.py (reported line 346)May include surrounding context.

python
payload = {'id': voice_id}
    
    url = f"{IDR_VIDEO_URL}/audio/speaker/preview"
    resp = requests.get(url, headers=get_client_header(), params=payload)
    resp.raise_for_status()
    data = resp.json()
    if data.get("code") == CODE_SUCCESS:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill requires environment-variable access and outbound network access, but the manifest does not explicitly scope or declare those capabilities. In an agent ecosystem, missing tool/permission boundaries can cause the skill to be invoked with broader privileges than users expect, increasing the chance of unintended credential exposure or external data transmission.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger keywords are generic phrases like '制作视频', '创建视频', and '生成视频', which are likely to match many ordinary user requests. Overbroad triggering can silently route unrelated prompts into this skill, causing unexpected network calls to a third-party service and disclosure of user content without clear intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description does not clearly warn that user text and selected media parameters will be transmitted to an external service for processing. This weakens informed consent and can lead users to disclose sensitive business or personal content believing the operation is local or internal.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file instructs the agent to directly present a fixed Chinese-language response to the user and all example interactions are in Chinese. This imposes a specific language on users without documenting a language requirement, offering a choice, or obtaining opt-in, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file’s name, description, headings, and instructions are written entirely in Chinese, and there is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This creates a natural-language policy concern because it imposes a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

All user-facing name, description, headings, examples, and reply instructions are written exclusively in Chinese, including expected pagination replies like '上一页' and '下一页'. This suggests a language constraint without any visible user opt-in or alternative locale choice, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation explicitly instructs users to list private avatars and exposes internal identifiers for non-public assets without any warning about authorization, privacy, or ownership checks. In an agent setting, this can normalize or facilitate access to private creative assets that may belong to other users or tenants if backend controls are weak or misconfigured.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest-style description '使用模板' ('use templates') is very broad and overlaps with common user intent language. There are no explicit trigger boundaries, exclusions, or narrower context cues in the file to clarify when this skill should activate versus when a general template-related request should not invoke it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file's name, description, headings, instructions, and example reply phrases are entirely in Chinese, including user-facing commands like replying with 【上一页】 and 【下一页】. This imposes a specific language on users without any opt-in or explanation that the skill is intentionally limited to Chinese-speaking contexts.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

The code uses an insecure default endpoint configuration because IDR_VIDEO_URL is plain HTTP, so Authorization credentials and transmitted content may traverse the network unencrypted. DEFAULT_AUTH being None is less serious, but the overall default transport posture is unsafe for a service handling tokens and uploaded content.

Content

Scanner excerpt · scripts/idr_video_client.py (reported line 9)May include surrounding context.

python
import argparse
from pathlib import Path

DEFAULT_AUTH = None
IDR_VIDEO_URL = "http://a1.neural-avatar.com:8004"
MEMORY_FILE = Path(__file__).parent / "memory.json"
CODE_SUCCESS = 200

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill transmits user-provided text to an external video-generation service. External transmission is expected for the feature, but it is still security-relevant because potentially sensitive prompts or business content leave the local environment and are subject to third-party handling.

Content

Scanner excerpt · scripts/idr_video_client.py (reported line 229)May include surrounding context.

python
headers = get_client_header()
    try:
        url = f"{IDR_VIDEO_URL}/video/skill/gen"
        resp = requests.post(url, headers=headers, json=payload)
        resp.raise_for_status()
        data = resp.json()
        if data.get("code") == CODE_SUCCESS:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The function uploads a user-specified local audio file to a remote service without any user-facing disclosure or confirmation. In an agent setting this matters because local file paths may be selected indirectly, causing users to unknowingly transmit private recordings or misselected files off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code persists user-provided text to a predictable local file in the current working directory without notice, consent, or cleanup. That can expose potentially sensitive script content to other local users, backups, logs, or later processes, especially in shared or ephemeral agent environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The assistant-facing help text in my_skill() is entirely in Chinese and assumes that locale for all users. This creates a language-policy issue because the file does not provide an opt-in, alternative language, or justification for restricting the interaction to Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This markdown file includes major user-facing instructions and example prompts in Chinese, while the document begins with an English description and does not state that the skill is intentionally Chinese-only or offer an alternative language. That can amount to a locale/language policy issue because the skill experience implicitly forces one language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The setup instructions tell users to store an API key in an environment variable but do not warn that the token is sensitive or should never be pasted into chat/output. In agent workflows, unclear credential handling guidance increases the risk of accidental token disclosure through prompts, logs, screenshots, or debugging output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

All user-facing natural-language content in the file is written in Chinese, including suggested reply phrases like '上一页' and '下一页', with no indication that other languages are supported or that the language is user-selectable. This may violate a language/locale policy if the organization requires user choice rather than a fixed language.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

The dependency manifest includes requests without a pinned version, which makes builds non-reproducible and can cause installation of different releases over time, including vulnerable or breaking versions. In a skill that likely performs network operations to create avatar/video content, dependency drift increases supply-chain risk and can expose the runtime to known flaws present in some requests releases.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests