AI Hookbot

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:56 AM UTC
• Version: 1.0.2

Overview

This skill has a coherent media-generation purpose, but it asks users to run unreviewed external pipeline code with local file and optional API-key access.

Review carefully before installing. Only use this skill with a trusted, pinned pipeline source that you have inspected, run it in a restricted working directory, avoid passing secrets unless necessary, confirm creator and output paths before execution, and do not publish downloaded or stitched content unless you have the rights to use it.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:24
• Finding: Mutable External Pipeline Is Retrieved and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:24-26` and `SKILL.md:69-78` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/YOUR_REPO/hookbot-scripts ~/hookbot ``` The retrieved pipeline is subsequently executed: ```bash cd "$SCRIPTS_DIR" && \ YTDLP_PATH="$YTDLP" \ FFMPEG_PATH="$FFMPEG" \ YOUTUBE_API_KEY="${YOUTUBE_API_KEY:-}" \ python3 pipeline.py "<creator_url>" "<cta_video>" \ --count <count> \ --hook-duration <hook_duration> \ --output <output_dir> \ [--viral] ``` ### Technical Analysis The audited package does not contain `pipeline.py` or the related pipeline implementation. Instead, it instructs users to clone code from an external Git repository and later execute that code with Python. No immutable commit identifier, release digest, cryptographic signature, or checksum is specified. Consequently, the effective executable payload can change after this Skill has been reviewed. The repository URL also contains the unresolved `YOUR_REPO` placeholder, increasing the likelihood that users or distributors will substitute an arbitrary or unverified repository. The external script receives the configured `YOUTUBE_API_KEY` through its environment and executes with the permissions of the OpenClaw process or invoking user. Therefore, compromise or substitution of the external repository would cross the security boundary between unaudited remote content and local code execution. ### Attack Path 1. An attacker gains control of the repository used in place of `YOUR_REPO`, compromises an existing repository, or persuades a user to configure a malicious repository. 2. The user follows the setup instructions and clones the mutable repository into the configured scripts directory. 3. A request triggers the Hookbot workflow. 4. The Skill runs the remotely obtained `pipeline.py`. 5. The malicious pipeline executes with the invoking process's privilege ...[truncated 837 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include the reviewed pipeline implementation directly in the Skill package. 2. If external retrieval is unavoidable, use an official repository and pin it to an immutable commit hash. 3. Publish and verify a cryptographic checksum or signed release before executing any downloaded files. 4. Abort execution if repository identity, commit identity, signature validation, or checksum validation fails. 5. Replace the unresolved `YOUR_REPO` placeholder with an authenticated, documented source. 6. Review the pipeline's source code and dependency lock files as part of the same security audit. 7. Do not expose `YOUTUBE_API_KEY` or other credentials to code until its identity and integrity have been verified. 8. Run media-processing code in a sandbox with restricted filesystem, network, and environment access. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:69
• Finding: User-Controlled Values Are Inserted Into a Shell Command Without Consistent Quoting or Validation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:69-78` **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash cd "$SCRIPTS_DIR" && \ YTDLP_PATH="$YTDLP" \ FFMPEG_PATH="$FFMPEG" \ YOUTUBE_API_KEY="${YOUTUBE_API_KEY:-}" \ python3 pipeline.py "<creator_url>" "<cta_video>" \ --count <count> \ --hook-duration <hook_duration> \ --output <output_dir> \ [--viral] ``` ### Technical Analysis The workflow states that `count`, `hook_duration`, and `output_dir` are extracted from the user's request. The command template quotes `creator_url` and `cta_video`, but does not quote the placeholders used for `count`, `hook_duration`, and `output_dir`. If the Agent performs direct textual substitution and sends the resulting command to a shell, shell metacharacters in those fields can be interpreted as operators rather than argument data. Numeric-looking parameters are not accompanied by strict type or range validation, and the output path is not constrained to an approved root. Quoting alone is not a complete defense where a shell is involved. The safest implementation is to bypass shell parsing and invoke Python with a structured argument array. ### Attack Path 1. An attacker supplies a request containing shell syntax in a field such as the output directory, count, or hook duration. 2. The Agent extracts the attacker-controlled text and substitutes it into the documented command template. 3. The resulting command is executed through a shell. 4. The shell interprets injected metacharacters, command substitutions, redirections, or additional commands. 5. The injected command executes with the same privileges as the Agent process. For example, an output value containing a shell separator could terminate the intended argument and append another command if inserted without validation or safe argument handling. ### Impact Assessment Successful exploitation can provide arbitrary command execution under the ident ...[truncated 435 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not construct the invocation through shell string interpolation. 2. Execute the pipeline with a structured argument vector, for example through an API equivalent to: ```python subprocess.run( [ "python3", pipeline_path, creator_url, cta_video, "--count", str(count), "--hook-duration", str(hook_duration), "--output", output_dir, ], shell=False, check=True, env=restricted_env, ) ``` 3. Parse `count` as an integer and enforce a reasonable positive range. 4. Parse `hook_duration` as a finite numeric value and enforce minimum and maximum durations. 5. Resolve `output_dir` to a canonical path and require it to remain beneath an approved output root. 6. Validate creator URLs against an explicit HTTPS YouTube host allowlist. 7. Reject newline characters, control characters, and unexpected shell metacharacters in textual inputs as defense in depth. 8. If shell execution cannot be removed, quote every generated argument using a platform-appropriate escaping routine rather than manual quotation. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17
• Finding: Dependencies and Executables Are Unpinned and Resolved Through PATH<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-18` and `config.example.env:12-16` **Vulnerability Type**: Insecure dependency and executable resolution **Risk Level**: Medium ### Vulnerable Code ```bash pip install yt-dlp brew install ffmpeg # macOS; or apt install ffmpeg on Linux ``` The default configuration relies on PATH lookup: ```bash # Path to yt-dlp binary (leave as-is if it's in your PATH) export HOOKBOT_YTDLP_PATH="yt-dlp" # Path to ffmpeg binary (leave as-is if it's in your PATH) export HOOKBOT_FFMPEG_PATH="ffmpeg" ``` ### Technical Analysis The installation instructions do not pin a reviewed `yt-dlp` version or provide package hashes. Installation through generic package-manager commands therefore retrieves whichever version is current at installation time. The reviewed Skill cannot guarantee that this later-resolved package is the version that was assessed. The default executable values are bare command names. They are resolved according to the process's PATH, allowing a malicious or unintended executable located earlier in PATH to impersonate `yt-dlp` or `ffmpeg`. Although standard package managers are legitimate sources, the absence of version and integrity controls weakens reproducibility and supply-chain assurance. PATH-based resolution also creates a local binary-shadowing attack surface. ### Attack Path A PATH-shadowing exploitation path is: 1. An attacker who can write to a directory appearing before the legitimate binary directory places a malicious executable named `yt-dlp` or `ffmpeg` there. 2. The default configuration retains the bare executable name. 3. The pipeline resolves the executable through PATH. 4. The attacker's executable runs with the privileges and environment of the Hookbot pipeline. A dependency-supply-chain exploitation path is: 1. A package source, package account, mirror, or newly published dependency version is compromised. 2. A user runs the unpinned installation command. 3. The pac ...[truncated 670 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin Python dependencies to reviewed versions in a lock file. 2. Use hash verification, such as pip's `--require-hashes`, for downloaded Python artifacts. 3. Document reviewed package-manager versions or immutable package references for FFmpeg. 4. Resolve dependencies to canonical absolute paths during setup. 5. Verify binary ownership, permissions, provenance, and expected digest before pipeline execution. 6. Use a minimal, controlled PATH that excludes user-writable and project-writable directories. 7. Run dependencies in a restricted environment without unnecessary credentials. 8. Add a preflight check that rejects unexpected executable paths or versions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:80
• Finding: Contradictory Error-Handling Instructions Can Disclose Credentials and Local Paths<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:80-84` and `SKILL.md:105` **Vulnerability Type**: Sensitive information disclosure through error output **Risk Level**: Medium ### Vulnerable Code The reporting workflow requires sanitization: ```text 4. Report back a summary: - How many hooks were scraped - How many final videos were created - Output directory path - Any failures (sanitize error output before relaying — strip file paths and env var values) ``` A later instruction contradicts that requirement: ```text - If the pipeline errors, relay the error output to the user verbatim so they can debug. ``` ### Technical Analysis The instruction to return pipeline errors verbatim conflicts directly with the earlier requirement to remove file paths and environment values. Agent behavior may follow the later and more specific-looking instruction, bypassing sanitization. The pipeline is explicitly provided with `YOUTUBE_API_KEY` in its environment. External tools and Python exceptions may also expose command-line arguments, local filesystem paths, media filenames, configuration values, stack traces, or subprocess environments. Returning such output without redaction creates a disclosure channel. Because the actual pipeline is absent from the audited package, it is not possible to verify whether its error messages already suppress sensitive values. The Skill must therefore treat all subprocess output as untrusted and potentially sensitive. ### Attack Path 1. The pipeline or one of its dependencies fails. 2. The failure output contains a local path, command line, environment value, API key, or other sensitive diagnostic information. 3. The Agent follows the instruction to relay the error output verbatim. 4. The sensitive diagnostic content is returned to the requester. 5. A disclosed API key may subsequently be used against the associated YouTube API project within its configured permissions and quota. A malicious external pipel ...[truncated 770 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction to relay errors verbatim. 2. Establish one unambiguous rule requiring sanitization of all subprocess output before it is returned. 3. Redact API keys, tokens, environment values, home-directory paths, command lines, and sensitive filenames. 4. Return a stable error code and a concise sanitized summary to the requester. 5. Store detailed diagnostics only in a permission-restricted local log, with secrets removed before writing. 6. Pass only variables strictly required by the pipeline rather than inheriting the full Agent environment. 7. Restrict the YouTube API key by API, application context where applicable, quota, and project permissions. 8. Add tests containing synthetic secrets and paths to verify that redaction works across stdout, stderr, exceptions, and nested subprocess errors. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The introductory description explains the media-processing workflow but does not prominently warn that the skill downloads third-party YouTube content and writes generated MP4 outputs to disk. In practice, this can mislead users or higher-level agents about the side effects of invoking the skill, increasing the risk of unexpected external access, storage use, and potential policy or copyright issues.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The README uses broad conversational trigger examples like 'Make me 10 hooks' and 'Run hookbot', which can cause an agent platform to invoke the skill on ambiguous user requests without clearly signaling that it will download third-party videos and generate files. In an agentic environment, overly broad natural-language activation increases the chance of unintended execution, especially when the action includes network access, media downloading, and filesystem writes.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: ai-hookbot
description: Scrape viral hooks from YouTube Shorts creators and stitch them with a CTA video to produce ready-to-post TikTok/Reels/Shorts content. Use when asked to make hooks, scrape Shorts, create content from a creator, or run the Hookbot pipeline. Triggers on phrases like "make me hooks from @X", "scrape hooks", "run hookbot", "create content from [creator]", "stitch my CTA".
---

# AI Hookbot

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad enough that the skill may activate on ambiguous user requests such as 'create content from [creator]' or 'stitch my CTA' without an explicit request to run a scraping and file-writing pipeline. This increases the chance of unintended execution of external-network and local file operations.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill description does not clearly warn users that it will scrape external content, invoke local tools, and create output files on disk. Without upfront disclosure, users may not understand the privacy, copyright, and system-side effects of invoking the skill.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The skill gives contradictory instructions: one section says to sanitize pipeline error output before returning it, while a later note says to relay errors verbatim. If followed literally, the agent may disclose local file paths, command details, or environment-derived values from subprocess failures, which can leak sensitive system information to the user.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The conflicting guidance on sanitizing versus relaying errors verbatim directly creates an information disclosure risk. Subprocess errors from yt-dlp, ffmpeg, or Python commonly include absolute paths, usernames, command arguments, and environment-influenced details that should not be exposed unredacted.

Static analysis

No suspicious patterns detected.