Security audit

Clip Media

Security checks for vulnerabilities and agentic risk

Overview

This media-download skill is mostly coherent, but its public upload path can send files to a different host than the user selected and it includes other high-impact handling risks.

Review this before installing if you will handle private, paid, copyrighted, regulated, or confidential media. Avoid browser-wide cookie access unless you understand that it can expose active sessions. Do not rely on --cloud to choose a specific upload host in this version, and prefer --no-upload for sensitive files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: extract.js:315
Finding: Explicit Cloud Provider Selection Is Ignored
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: extract.js:412
Finding: Untrusted Remote Metadata Is Used to Construct a Download Path
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: clawhub.yaml:14
Finding: External Downloader Dependency Is Unpinned and Resolved Through PATH
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 95% confidence
Finding: This skill explicitly instructs use of --cookies-from-browser chrome, which extracts active browser session cookies and can expose authentication tokens for every logged-in site in that browser profile. Even though the document includes warnings, the capability materially increases the risk of credential/session theft, unauthorized access to private or paid content, and cross-account compromise if the extracted cookies are mishandled or the skill is used in an automated agent context.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
md
ull access: | Platform | Needs cookies? | |----------|---------------| | Instagram | Sometimes (private content, full resolution) | | X / Twitter | Sometimes (rate limits, some content) | | Patreon | Yes (paid content) | | OnlyFans | Yes | | Fanvue / Fansly | Yes | | Netflix / HBO / Disney+ | Via browser cookies | | YouTube | Rarely (age-restricted content) | **If cookies are needed:** - Use `--cookies-from-browser chrome` as a **last resort** — it exposes ALL platform session tokens in that browser - Warn the user that this could enable unauthorized account access if the machine is compromised - Prefer manual cookie paste or API keys when available - Never use `--cookies-from-browser` with paid/sensitive platforms unless the user explicitly consents to the risk - Consider exporting cookies from only the specific browser/profile needed, not the default one ## How It Works (Under the Hood) 1. **Analyze**: `yt-dlp --dump-json` detects the platform and media type 2. **Download**: `y

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill includes functionality to upload downloaded media to public file-hosting services like tmpfiles.org and transfer.sh, which is not necessary for core media extraction and creates a clear data-exfiltration path. Although the code requires a --confirm-upload flag in some cases, it still enables disclosure of potentially sensitive downloaded content to third-party public services, increasing privacy, compliance, and unauthorized sharing risks.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill invokes additional system binaries such as tar and curl beyond the stated extraction tool yt-dlp, expanding the attack surface and enabling file packaging and outbound network transfer. While these calls use argument arrays rather than shell interpolation, they still materially increase capability from local extraction to compression and external publication of files.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: extract.js:5