ClawHub
Back to skill

Security audit

CreateVideo Podcast to Video

Security checks for vulnerabilities and agentic risk

Overview

The skill’s video workflow is coherent, but it needs review because it tells users to run an unversioned third-party MCP server from npm that could change after review.

Before installing, pin and verify the ListenHub MCP server version or run it in a restricted environment with minimal file, environment-variable, and network access. Avoid sending confidential text to the TTS flow unless you trust the MCP server and its service handling.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:136
Finding

Unpinned Third-Party MCP Package Is Downloaded and Executed Automatically

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:136-140; duplicated in references/listenhub-guide.md:3-7
Vulnerability Type: Supply-chain risk caused by unpinned dependency execution
Risk Level: Medium

Vulnerable Code

SKILL.md:136-140:

bash
### 1. Install MCP Server

```bash
npx -y @marswave/listenhub-mcp-server
text

`references/listenhub-guide.md:3-7`:

```bash
## Installation

```bash
npx -y @marswave/listenhub-mcp-server
text

### Technical Analysis

The documented installation command instructs users to run an unversioned third-party npm package through `npx`. Because no exact version is specified, npm resolves the package version from the configured registry at installation time. The `-y` option automatically accepts the installation prompt, reducing the opportunity for the user to inspect the resolved package before execution.

An npm package executed through `npx` may run package entry points and lifecycle behavior with the privileges of the account invoking the command. The project does not provide a lockfile, integrity hash, verified artifact, trusted-source policy, or reviewed version for this dependency. Consequently, the code executed during installation can differ from the code available when the Skill was audited.

This is particularly relevant because the MCP server is subsequently intended to process user-provided text for text-to-speech operations. A compromised dependency could potentially access that content as well as resources exposed to the local process.

### Attack Path

1. An attacker compromises the npm package, its publisher account, the configured package registry, or a future package release.
2. The attacker publishes a malicious version under `@marswave/listenhub-mcp-server`.
3. A user follows the Skill instructions and runs:
   ```bash
   npx -y @marswave/listenhub-mcp-server
   ```
4. `npx` resolves and downloads the mutable package ver
...[truncated 1215 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact reviewed version rather than resolving the latest release:
    bash
    npx -y @marswave/listenhub-mcp-server@<reviewed-exact-version>
  2. Record the dependency in a package manifest and commit a lockfile with integrity metadata. Use npm ci or an equivalent reproducible installation mechanism.
  3. Verify package provenance, publisher identity, registry source, signatures, and integrity hashes before execution.
  4. Remove automatic confirmation where practical and require users or administrators to approve the resolved package and version explicitly.
  5. Review new package versions before updating the pinned version.
  6. Run the MCP server in a restricted environment with:
    • A dedicated, unprivileged operating-system account.
    • Minimal filesystem access.
    • No unnecessary environment variables or credentials.
    • Restricted outbound network access.
    • Resource and process limits.
  7. Clearly disclose that user-provided text is processed through an external MCP component and avoid sending confidential content unless its handling and retention policies have been verified.
  8. Update both SKILL.md and references/listenhub-guide.md so the duplicated installation instructions consistently use the hardened installation method.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill hard-codes language: "zh" for the TTS request, which imposes a specific language choice rather than offering the user a language or locale selection. The document does not justify this as a region-specific or compliance-bound tool, so it appears to violate the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs operators to install and execute an MCP server directly from npm using an unpinned package reference, which allows future upstream package changes or a supply-chain compromise to alter what gets installed. Because MCP servers run with tool-level access in the agent environment, a malicious or trojaned update could gain broad access to local files, network resources, and user data.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The documentation instructs users to run an unpinned package via npx, which fetches the latest published version at execution time. This creates a supply-chain risk: a malicious update, account compromise, or unexpected breaking change in the upstream package could cause arbitrary code to run in the user's environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation hard-codes the language parameter to "zh", which imposes a specific language choice. This is a natural-language policy concern because the file does not indicate that other languages are optional or that the user can opt into this locale restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.