ClawHub
Back to skill

Security audit

Mediaclaw Skill

Security checks for vulnerabilities and agentic risk

Overview

MediaClaw is a coherent video-production skill, but it needs review because it promotes face, voice, brand replacement, and anti-duplicate media generation without clear consent, privacy, or installation safeguards.

Review before installing or using. Only use videos, faces, voices, brands, and commercial assets you are authorized to modify; avoid impersonation or misleading substitutions; and prefer a pinned, verified ClawHub install command rather than running an unpinned `npx` command in a sensitive environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:5
Finding

Unpinned npm CLI Package Execution During Installation

Content
View full analysis

Vulnerability Details

File Location: README.md:5-8
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code:

markdown
## Install
```bash
npx clawhub install mediaclaw
text

### Technical Analysis

The documented installation command invokes `clawhub` through `npx` without specifying an exact package version or integrity value. If the package is not already available locally, `npx` can retrieve and execute the package distributed under that mutable npm registry name.

Because the dependency is not pinned, the code executed when users follow these instructions may differ from the version that was available when this project was audited. This creates a supply-chain trust boundary in which compromise of the package, its publisher account, or its transitive dependencies could result in attacker-controlled code being executed during installation.

### Attack Path

1. An attacker compromises the npm publisher account, package, release process, or a relevant transitive dependency for `clawhub`.
2. The attacker publishes a malicious version under the same package name.
3. A user follows the installation command from `README.md`.
4. `npx` resolves and downloads the current mutable package version.
5. The malicious CLI or applicable package lifecycle code executes with the privileges of the user running the command.
6. The payload can access resources available to that user and may alter the installation process or install a modified Skill.

### Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. The accessible scope could include user-readable files, environment variables, credentials available to the process, writable project files, and network resources reachable by that user. If the command is run from a privileged account or environment, the impact would increase accordingly. Exploitation depends
...[truncated 149 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin clawhub to an exact, reviewed version instead of resolving the latest available release, for example by using an exact version in the npx command.
  • Verify and document the package's official registry namespace and publisher identity.
  • Use npm lockfiles and registry integrity metadata where installation architecture permits.
  • Review the pinned package and its transitive dependency tree before recommending execution.
  • In automated or sensitive environments, download and verify the package artifact before execution rather than allowing transient retrieval and immediate execution.
  • Add a controlled upgrade process that reviews new package versions before changing the documented version.
  • Advise users not to run the installation command with elevated privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The README instructs users to execute npx clawhub install mediaclaw without pinning a specific package version. This can cause consumers to fetch and run whatever version is current at install time, increasing supply-chain risk if the package is updated maliciously, compromised, or changed incompatibly. In a skill-distribution context, install commands are routinely copied and executed, which makes this more dangerous than passive documentation text.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly promotes face swap, brand replacement, and voiceover replacement but does not warn users about deception, consent, impersonation, or misuse risks. In a media-production context, these capabilities can be used to create misleading or manipulative content, so the omission of safety framing increases the chance of harmful use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill asks users to provide source videos and brand assets for analysis and transformation but provides no notice about privacy, ownership, or sensitive data handling. Users may upload videos containing faces, voices, locations, or confidential branding materials without understanding retention, sharing, or processing risks.

Content

No source excerpt is available for this finding.