ClawHub
Back to skill

Security audit

video 生成流水线

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its stated video-generation purpose, but its script can send your Zhipu API key and storyboard prompts to any API base configured in the environment.

Review before installing. Use it only in a trusted project environment, keep ZHIPUAI_API_KEY out of source control, and do not set BIGMODEL_API_BASE unless you fully trust the endpoint. The skill should ideally restrict API calls to the official Zhipu HTTPS host before broad use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/video-generate.py:43
Finding

Unrestricted API Base Can Expose API Credentials and Storyboard Prompts

Content
View full analysis
Remediation
View remediation
str: parsed = urlsplit(base) if parsed.scheme != "https": raise ValueError("The API base must use HTTPS") if parsed.hostname not in ALLOWED_API_HOSTS: raise ValueError("Untrusted API hostname") if parsed.username or parsed.password: raise ValueError("Credentials must not be embedded in the API URL") if parsed.port not in (None, 443): raise ValueError("Unexpected API port") return base.rstrip("/") ``` ]]>

SkillSpector

Vulnerability Patterns
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description frames the behavior as a simple storyboard-to-video pipeline, but the actual instructions require file creation and trigger external network calls via a Python script, with optional downloading of remote content. When behavior and declared metadata diverge, users and enforcement systems may authorize the skill under false assumptions, enabling unexpected data egress, filesystem changes, and execution of side-effectful operations.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
**约定路径（项目根目录 = 与 `SKILL.md` 同级）**

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/video-generate.py (reported line 144)May include surrounding context.

python
if not p or not str(p).strip():
                raise ValueError(f"segments[{i}] missing prompt")
            prompts.append(str(p).strip())
        return prompts
    if "prompts" in data:
        ps = data["prompts"]
        if not isinstance(ps, list) or len(ps) != EXPECTED_SEGMENTS:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill instructs the agent to read an environment variable, write files under the project root, and invoke a script that performs outbound HTTPS requests, yet it declares no explicit tool scope or permissions. This creates an authorization gap: an agent/runtime may permit broader capabilities than users expect, reducing reviewability and increasing the chance of unintended file or network access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The JSON example uses Chinese titles for the segment names while the rest of the content is in English, which suggests a language preference is being imposed in the artifact without any documented user choice. Under the language/locale policy rule, this can be treated as a natural-language policy concern because the file does not explain that multilingual output is intentional or optional.

Content

No source excerpt is available for this finding.