Security audit

AI Hookbot

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent media-generation purpose, but it asks users to run unreviewed external pipeline code with local file and optional API-key access.

Review carefully before installing. Only use this skill with a trusted, pinned pipeline source that you have inspected, run it in a restricted working directory, avoid passing secrets unless necessary, confirm creator and output paths before execution, and do not publish downloaded or stitched content unless you have the rights to use it.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:24
Finding: Mutable External Pipeline Is Retrieved and Executed Without Integrity Verification
Content: View full analysis
" "" \ --count \ --hook-duration \ --output \ [--viral] ``` ### Technical Analysis The audited package does not contain `pipeline.py` or the related pipeline implementation. Instead, it instructs users to clone code from an external Git repository and later execute that code with Python. No immutable commit identifier, release digest, cryptographic signature, or checksum is specified. Consequently, the effective executable payload can change after this Skill has been reviewed. The repository URL also contains the unresolved `YOUR_REPO` placeholder, increasing the likelihood that users or distributors will substitute an arbitrary or unverified repository. The external script receives the configured `YOUTUBE_API_KEY` through its environment and executes with the permissions of the OpenClaw process or invoking user. Therefore, compromise or substitution of the external repository would cross the security boundary between unaudited remote content and local code execution. ### Attack Path 1. An attacker gains control of the repository used in place of `YOUR_REPO`, compromises an existing repository, or persuades a user to configure a malicious repository. 2. The user follows the setup instructions and clones the mutable repository into the configured scripts directory. 3. A request triggers the Hookbot workflow. 4. The Skill runs the remotely obtained `pipeline.py`. 5. The malicious pipeline executes with the invoking process's privilege ...[truncated 837 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:69
Finding: User-Controlled Values Are Inserted Into a Shell Command Without Consistent Quoting or Validation
Content: View full analysis
" "" \ --count \ --hook-duration \ --output \ [--viral] ``` ### Technical Analysis The workflow states that `count`, `hook_duration`, and `output_dir` are extracted from the user's request. The command template quotes `creator_url` and `cta_video`, but does not quote the placeholders used for `count`, `hook_duration`, and `output_dir`. If the Agent performs direct textual substitution and sends the resulting command to a shell, shell metacharacters in those fields can be interpreted as operators rather than argument data. Numeric-looking parameters are not accompanied by strict type or range validation, and the output path is not constrained to an approved root. Quoting alone is not a complete defense where a shell is involved. The safest implementation is to bypass shell parsing and invoke Python with a structured argument array. ### Attack Path 1. An attacker supplies a request containing shell syntax in a field such as the output directory, count, or hook duration. 2. The Agent extracts the attacker-controlled text and substitutes it into the documented command template. 3. The resulting command is executed through a shell. 4. The shell interprets injected metacharacters, command substitutions, redirections, or additional commands. 5. The injected command executes with the same privileges as the Agent process. For example, an output value containing a shell separator could terminate the intended argument and append another command if inserted without validation or safe argument handling. ### Impact Assessment Successful exploitation can provide arbitrary command execution under the ident ...[truncated 435 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:17
Finding: Dependencies and Executables Are Unpinned and Resolved Through PATH
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:80
Finding: Contradictory Error-Handling Instructions Can Disclose Credentials and Local Paths
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The introductory description explains the media-processing workflow but does not prominently warn that the skill downloads third-party YouTube content and writes generated MP4 outputs to disk. In practice, this can mislead users or higher-level agents about the side effects of invoking the skill, increasing the risk of unexpected external access, storage use, and potential policy or copyright issues.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README uses broad conversational trigger examples like 'Make me 10 hooks' and 'Run hookbot', which can cause an agent platform to invoke the skill on ambiguous user requests without clearly signaling that it will download third-party videos and generate files. In an agentic environment, overly broad natural-language activation increases the chance of unintended execution, especially when the action includes network access, media downloading, and filesystem writes.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: ai-hookbot description: Scrape viral hooks from YouTube Shorts creators and stitch them with a CTA video to produce ready-to-post TikTok/Reels/Shorts content. Use when asked to make hooks, scrape Shorts, create content from a creator, or run the Hookbot pipeline. Triggers on phrases like "make me hooks from @X", "scrape hooks", "run hookbot", "create content from [creator]", "stitch my CTA". --- # AI Hookbot

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough that the skill may activate on ambiguous user requests such as 'create content from [creator]' or 'stitch my CTA' without an explicit request to run a scraping and file-writing pipeline. This increases the chance of unintended execution of external-network and local file operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill description does not clearly warn users that it will scrape external content, invoke local tools, and create output files on disk. Without upfront disclosure, users may not understand the privacy, copyright, and system-side effects of invoking the skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill gives contradictory instructions: one section says to sanitize pipeline error output before returning it, while a later note says to relay errors verbatim. If followed literally, the agent may disclose local file paths, command details, or environment-derived values from subprocess failures, which can leak sensitive system information to the user.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The conflicting guidance on sanitizing versus relaying errors verbatim directly creates an information disclosure risk. Subprocess errors from yt-dlp, ffmpeg, or Python commonly include absolute paths, usernames, command arguments, and environment-influenced details that should not be exposed unredacted.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.