ClawHub
Back to skill

Security audit

Video Understanding

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward video-analysis helper with disclosed network/API use and optional download-tool guidance, with no hidden persistence, credential theft, or destructive behavior found.

Install only if you are comfortable with the agent fetching video metadata from third-party platforms and, when needed, using tools like `yt-dlp`. Prefer a pinned, vetted install in a virtual environment, avoid exposing secrets to the media-processing environment, and use downloads only where you have rights and platform terms allow it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/resources.md:42
Finding

Unpinned Third-Party Package Installation

Content
View full analysis

Vulnerability Details

File Location: references/resources.md, line 42
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
pip install yt-dlp

Technical Analysis

The documented installation command retrieves the latest version of yt-dlp and its transitive dependencies without a version constraint, cryptographic hash verification, lockfile, explicit trusted package index, or isolated execution environment.

Because package resolution is mutable, the code installed when the command is executed may differ from the dependency version reviewed during the Skill audit. If the upstream package, a transitive dependency, package repository, or dependency-resolution process is compromised, attacker-controlled code could execute during installation or subsequent invocation.

No evidence indicates that yt-dlp is currently malicious. The vulnerability is the unsafe and non-reproducible dependency acquisition process.

Attack Path

  1. A user asks the agent to analyze, download, or extract content from a video.
  2. The agent follows the installation guidance in references/resources.md.
  3. pip resolves the latest available yt-dlp release and its transitive dependencies from the configured package index.
  4. An attacker who has compromised an upstream release, dependency, maintainer account, repository, or package-resolution source supplies malicious package content.
  5. The malicious code executes during package installation or when the installed tool is invoked.
  6. The payload runs with the privileges and environment access of the user or agent process that executed the command.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the installing process. Depending on that process's permissions, the attacker could access files, environment variables, API credentials, network resources, and other data available t ...[truncated 166 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin yt-dlp to a specifically reviewed version rather than installing the mutable latest release.
  2. Use a requirements or lock file containing cryptographic hashes, and install with hash enforcement, for example:
bash
python -m pip install --require-hashes -r requirements.txt
  1. Pin and verify all transitive dependencies, not only the direct dependency.
  2. Configure an explicit trusted package index or an internally controlled artifact repository.
  3. Install the dependency inside a dedicated virtual environment or container running with least privilege.
  4. Avoid exposing secrets or sensitive host directories to the installation and media-processing environment.
  5. Perform dependency vulnerability and provenance checks before updating the pinned version.
  6. Prefer a pre-provisioned, integrity-verified tool maintained by the deployment environment instead of allowing the Skill to install packages dynamically.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description is broadly framed around any request to analyze or summarize video content, which can cause the agent to invoke this skill in situations where the user did not explicitly request external fetching or platform-specific processing. Overbroad activation increases the chance of inappropriate tool use, incorrect routing, or unintended processing of untrusted URLs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger scenarios include catch-all phrases like requests to 'understand,' 'analyze,' 'summarize,' or 'extract' video content, without precise boundaries. This ambiguity can make the agent over-activate the skill for loosely related prompts, leading to unnecessary network access, mishandling of untrusted links, or bypass of more appropriate safer skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Mandating Chinese output regardless of the user's language preference can override higher-priority user expectations and system behavior, creating prompt-control issues and reducing transparency. While not directly enabling code execution or data exfiltration, it can cause incorrect or misleading responses and interfere with safe, user-aligned operation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. This reference file forces a single language presentation without any opt-in, fallback, or justification that it is intended only for a Chinese-language audience.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/resources.md (reported line 22)May include surrounding context.

获取视频信息

bash
# bv号转av号
curl "https://api.bilibili.com/x/web-interface/view?bvid=BV1xxx"

# av号获取
curl "https://api.bilibili.com/x/web-interface/view?aid=170001"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/resources.md (reported line 25)May include surrounding context.

获取视频信息

bash
# bv号转av号
curl "https://api.bilibili.com/x/web-interface/view?bvid=BV1xxx"

# av号获取
curl "https://api.bilibili.com/x/web-interface/view?aid=170001"

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This is a markdown file, so SQP-2 applies to user-facing descriptions and examples that may affect user data, privacy, or system integrity. The section provides direct yt-dlp commands for downloading videos, audio, and subtitles, but does not include any warning about respecting platform terms, copyright, or the fact that local files will be created.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.