ClawHub
Back to skill

Security audit

Video Editing

Security checks for vulnerabilities and agentic risk

Overview

This video-editing skill is mostly coherent, but it needs Review because it gives cloud media-upload and face-swap guidance without adequate privacy, consent, or safety scoping.

Review this skill before installing if you handle private, regulated, workplace, client, or identity-sensitive media. Use local workflows for confidential footage, avoid uploading media to third-party APIs unless you accept that provider's terms, keep API keys secure, use isolated environments for pip-installed tools, and do not use face-swap or age-modification workflows without clear consent and lawful, non-deceptive intent.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T08 · Insecure Dependencies

Warning
Location
audio.md:91
Finding

Unpinned Demucs Dependency Creates a Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: audio.md:91-94
Vulnerability Type: Unpinned third-party Python dependency
Risk Level: Medium

bash
# Using demucs (separate vocals)
pip install demucs
demucs --two-stems=vocals input.mp4

Technical Analysis

The Skill directs users to install and execute demucs from the Python package index without specifying an reviewed version, verifying package hashes, using a lock file, or requiring an isolated environment. Package resolution can therefore change after the Skill has been reviewed.

Python packages may execute code during installation or when their command-line entry points are invoked. If the configured package index, package release, maintainer account, or dependency chain is compromised, following this instruction could execute attacker-controlled code under the invoking user's account. No evidence establishes that the current demucs package is malicious; the vulnerability is the unsafe dependency acquisition process.

Attack Path

  1. An attacker compromises the package, a transitive dependency, its maintainer account, or the package index used by the victim.
  2. The attacker publishes a malicious release that satisfies the unpinned installation request.
  3. A user follows the documented pip install demucs instruction.
  4. pip dynamically resolves and installs the malicious or compromised release.
  5. Malicious code runs during installation or when the user invokes demucs.
  6. The payload operates with the permissions of the user who ran the command.

Impact Assessment

Successful exploitation can provide arbitrary code execution with the invoking user's privileges. The payload could read or modify accessible media, project files, credentials, and configuration; make network requests; tamper with generated output; or install additional user-level components. The instruction does not request elevation, so administrative or root access is not ...[truncated 84 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin demucs and all transitive dependencies to reviewed versions in a lock file.
  • Distribute and verify cryptographic hashes, using pip install --require-hashes -r requirements.txt.
  • Install into a dedicated virtual environment rather than the system Python environment.
  • Document the approved package index and use HTTPS with normal certificate verification.
  • Review package provenance, release signatures where available, maintainers, and dependency changes before updating.
  • Avoid sudo pip install and run the tool with access limited to the required input and output directories.

T08 · Insecure Dependencies

Warning
Location
effects.md:7
Finding

Unpinned RIFE Package Installation Creates a Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: effects.md:7-12
Vulnerability Type: Unpinned third-party Python dependency
Risk Level: Medium

bash
# Install
pip install rife-ncnn-vulkan

# Interpolate (2x frames)
rife-ncnn-vulkan -i input.mp4 -o output.mp4 -m rife-v4.6

Technical Analysis

The Skill installs rife-ncnn-vulkan directly from the active Python package index without a version constraint, package hash, reviewed lock file, or isolation requirement. Consequently, the effective code installed by this instruction can change independently of the audited Skill content.

Installation hooks, imported modules, native components, and command-line entry points can execute code locally. Compromise of the package, a dependency, a maintainer account, or the configured index could therefore turn this workflow into arbitrary code execution. The audit did not establish that the current package is malicious; the risk arises from installing mutable, unverified third-party content.

Attack Path

  1. An attacker gains control over a package release, transitive dependency, maintainer account, or package distribution path.
  2. A malicious release becomes the version selected by the unpinned command.
  3. A user runs pip install rife-ncnn-vulkan as documented.
  4. The attacker's code is installed and may execute during installation.
  5. The user invokes rife-ncnn-vulkan, providing another opportunity for malicious runtime code to execute.
  6. The code accesses resources available to the invoking user.

Impact Assessment

Exploitation can result in arbitrary code execution with the user's effective privileges. Accessible videos, project assets, environment variables, credentials, and local configuration may be read, modified, deleted, or transmitted. Generated videos may also be silently manipulated. The documented workflow does not inherently grant elevated privileges, so the default scope is the invoking use ...[truncated 37 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the floating install with a reviewed, exact package version.
  • Pin transitive dependencies and record verified hashes in a lock file.
  • Require pip --require-hashes or an equivalent reproducible installation mechanism.
  • Use a dedicated virtual environment or container with no unnecessary secrets or filesystem mounts.
  • Verify the package publisher, source repository, release process, and native binary provenance.
  • Test upgrades in an isolated environment before changing the approved version.
  • Explicitly warn users not to install the package with administrative privileges.

T08 · Insecure Dependencies

Warning
Location
upscaling.md:33
Finding

Unpinned Video2X Dependency Creates a Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: upscaling.md:33-38
Vulnerability Type: Unpinned third-party Python dependency
Risk Level: Medium

bash
# Install
pip install video2x

# Upscale
video2x -i input.mp4 -o output.mp4 -p3 --scale 2

Technical Analysis

The Skill instructs users to install video2x without pinning a reviewed version or authenticating the selected artifacts with hashes. It also provides no lock file, trusted-index restriction, or isolated execution guidance. The installed implementation and dependency graph can therefore change after this Skill audit.

A malicious or compromised package release can execute code during installation or when the video2x entry point runs. This creates a supply-chain code-execution path, although the audit found no evidence that the currently published video2x package itself is malicious.

Attack Path

  1. An attacker compromises video2x, one of its dependencies, a publisher account, or the package index used by the victim.
  2. The attacker publishes a release selected by the unpinned install command.
  3. A user follows the Skill and runs pip install video2x.
  4. The compromised package or dependency is downloaded and installed.
  5. Attacker-controlled code executes during installation or when video2x processes the input video.
  6. The code acts with the invoking user's permissions and can access resources available in that execution context.

Impact Assessment

Exploitation may permit arbitrary user-level code execution, including access to source footage, output files, project directories, environment variables, stored credentials, and network resources available to the user. An attacker could exfiltrate media, corrupt files, or alter upscaled output. Root or administrator access is not directly requested by the documented commands and would require the user to run the installation with elevated privileges or an independent escalation pa ...[truncated 3 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin video2x and every transitive dependency to reviewed versions.
  • Supply a hash-locked requirements file and install with pip --require-hashes.
  • Use a project-specific virtual environment or a restricted container.
  • Limit runtime filesystem access to required input and output directories.
  • Verify package provenance and audit native executables or models acquired by the package.
  • Route upgrades through review and isolated testing rather than automatically accepting the latest release.
  • Do not run the installation or processing command as root or administrator.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (18)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The Runway API example sends user video data to a third-party service but does not clearly warn that media leaves the local environment. Video content often contains sensitive personal, workplace, or copyrighted material, so omission of an explicit privacy/transmission notice can lead to unintentional disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This code performs an outbound request to Runway's API to process video content, which constitutes external transmission of user data. In this skill's context that behavior is expected, but it is still security-relevant because it can transfer sensitive media off-device without an accompanying warning or data minimization guidance.

Content

Scanner excerpt · background-removal.md (reported line 19)May include surrounding context.

python
import requests

response = requests.post(
    "https://api.dev.runwayml.com/v1/video-to-video",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This code performs an outbound request to Runway's API to process video content, which constitutes external transmission of user data. In this skill's context that behavior is expected, but it is still security-relevant because it can transfer sensitive media off-device without an accompanying warning or data minimization guidance.

Content

Scanner excerpt · background-removal.md (reported line 19)May include surrounding context.

python
import requests

response = requests.post(
    "https://api.dev.runwayml.com/v1/video-to-video",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · background-removal.md (reported line 20)May include surrounding context.

md
import requests

response = requests.post(
    "https://api.dev.runwayml.com/v1/video-to-video",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={
        "model": "gen3a_turbo",

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · color-grading.md (reported line 43)May include surrounding context.

md
import requests

response = requests.post(
    "https://api.dev.runwayml.com/v1/video-to-video",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={
        "model": "gen3a_turbo",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The Unscreen instructions and API sample encourage uploading local video files to an external provider without any user-facing disclosure about data transmission. Because the example explicitly opens and uploads a local file, users may assume a local editing workflow and inadvertently expose sensitive video content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This request uploads a local file directly to Unscreen using the files parameter, creating a clear external data exfiltration path for video content. The danger is elevated because the example handles an on-disk file and provides no disclosure that the media is being sent to a third party.

Content

Scanner excerpt · background-removal.md (reported line 40)May include surrounding context.

API:

python
response = requests.post(
    "https://api.unscreen.com/v1.0/videos",
    headers={"X-Api-Key": API_KEY},
    files={"video": open("video.mp4", "rb")}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · background-removal.md (reported line 41)May include surrounding context.

API:

python
response = requests.post(
    "https://api.unscreen.com/v1.0/videos",
    headers={"X-Api-Key": API_KEY},
    files={"video": open("video.mp4", "rb")}
)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · color-grading.md (reported line 42)May include surrounding context.

python
import requests

response = requests.post(
    "https://api.dev.runwayml.com/v1/color-grade",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · color-grading.md (reported line 42)May include surrounding context.

python
import requests

response = requests.post(
    "https://api.dev.runwayml.com/v1/color-grade",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file introduces face-swapping and apparent age-modification features that materially expand the skill beyond the declared scope of background removal, grading, upscaling, stabilization, and enhancement. These capabilities can enable impersonation, deceptive media creation, and privacy abuse, and the mismatch between manifest and behavior reduces user and platform ability to apply appropriate safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The face-swap instructions provide actionable steps to create swapped videos while only saying 'Use responsibly, ethical concerns,' which is too weak to address privacy, consent, reputational, and impersonation risks. In a general video-editing skill, this makes harmful misuse easier because users receive operational guidance without meaningful safety constraints or warnings.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The Runway example demonstrates sending a video URL and API credentials to a third-party cloud service, but the surrounding documentation does not clearly warn users that media may leave their environment or that use requires a secret bearer token. In a video-editing skill this is contextually plausible and likely instructional rather than malicious, but it still creates a real privacy and data-handling risk if users submit sensitive or proprietary footage without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The finding duplicates the same outbound request example at line 83 and reflects the same issue: the skill includes a direct call to an external service without user-facing warning about transmission of media-related data. In this context the example is relevant to cloud video editing workflows, but it still increases risk because users may not realize that processing occurs off-device.

Content

Scanner excerpt · tools.md (reported line 83)May include surrounding context.

md
import requests

# Example: Remove background
response = requests.post(
    "https://api.dev.runwayml.com/v1/green-screen",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={"video_url": "https://..."}

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The finding duplicates the same outbound request example at line 83 and reflects the same issue: the skill includes a direct call to an external service without user-facing warning about transmission of media-related data. In this context the example is relevant to cloud video editing workflows, but it still increases risk because users may not realize that processing occurs off-device.

Content

Scanner excerpt · tools.md (reported line 83)May include surrounding context.

md
import requests

# Example: Remove background
response = requests.post(
    "https://api.dev.runwayml.com/v1/green-screen",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={"video_url": "https://..."}

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

The explicit third-party API URL confirms that this workflow depends on an external cloud provider, which may process user media outside the local environment. In a video-editing tools reference this is not inherently suspicious, but absent disclosure it can still lead to accidental sharing of sensitive footage or credentials-related misuse.

Content

Scanner excerpt · tools.md (reported line 84)May include surrounding context.

md
# Example: Remove background
response = requests.post(
    "https://api.dev.runwayml.com/v1/green-screen",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={"video_url": "https://..."}
)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The Replicate example uploads the input video to a third-party cloud service, but the skill provides no warning that user media leaves the local machine and may be processed or retained externally. In a video-editing context, users may apply this to sensitive or proprietary footage, so the omission can cause unintended data disclosure and privacy/compliance issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file includes a Runway API example that sends a video URL to an external service and authenticates with an API key. The surrounding documentation does not warn users that media references may be transmitted off-system or that an external credential is required.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.