ClawHub
Back to skill

Security audit

see-video

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it extracts frames from a user-provided video so a multimodal model can inspect them.

Use this skill only with videos you are allowed to share with the active multimodal model, because extracted frames are placed into model context. Prefer pinned or reviewed installs, honor the lockfile where possible, and avoid running npm or npx as a privileged user.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:140
Finding
Unpinned Third-Party Packages May Execute Mutable Supply-Chain Code<![CDATA[ ## Vulnerability Details **File Location**: `README.md:140-149`, `SKILL.md:33-38`, `package.json:3-5` **Vulnerability Type**: Unpinned and automatically executed third-party dependencies **Risk Level**: Medium ### Vulnerable Code `README.md:140-149`: ```markdown ## Installation ```bash # Via ClawHub npx clawhub@latest install see-video # Manual git clone https://github.com/john-ver/see-video cd see-video && npm install ``` ``` `SKILL.md:33-38`: ```markdown ## Setup (first time only) ```bash cd <skill directory> npm install ``` ``` `package.json:3-5`: ```json "dependencies": { "llm-frames": "^0.2.2" } ``` The committed lockfile currently resolves `llm-frames` version `0.2.2` from the official npm registry and includes an integrity hash: ```json "node_modules/llm-frames": { "version": "0.2.2", "resolved": "https://registry.npmjs.org/llm-frames/-/llm-frames-0.2.2.tgz", "integrity": "sha512-d5We/klIcWZFHuUHsR13DJ9BHA87ca5PUHgk9lc57ba8b3T9LeFueo8JW7IaWP5KjK5DwYuXu0yu6hEMzYq0WA==", "license": "MIT" } ``` ### Technical Analysis The documented `npx clawhub@latest` command downloads and executes the package version associated with the mutable `latest` distribution tag. Consequently, the code executed by future installations can differ from the version reviewed during this audit. The `llm-frames` dependency is also declared with the caret range `^0.2.2`, allowing npm dependency resolution to select later semver-compatible releases when the lockfile is not strictly enforced. The instructions recommend `npm install` rather than deterministic installation with `npm ci`. Although the current lockfile limits this risk when honored, the package manifest itself does not pin the dependency exactly. npm packages may define lifecycle scripts that run during installation. Therefore, compromise of an allowed package release or publisher account could turn an otherwise routine installation into arbitrary local code execution. No evidence was found t ...[truncated 1560 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace the mutable ClawHub invocation with an exact, reviewed version: ```bash npx clawhub@<reviewed-version> install see-video ``` 2. Pin `llm-frames` to an exact version in `package.json`: ```json "dependencies": { "llm-frames": "0.2.2" } ``` 3. Update setup documentation to use the committed lockfile deterministically: ```bash npm ci ``` 4. Keep `package.json` and `package-lock.json` synchronized and require lockfile changes to undergo code review. 5. Inspect dependency lifecycle scripts before upgrades. Where compatible with the package, disable automatic lifecycle-script execution: ```bash npm ci --ignore-scripts ``` 6. Run dependency installation in a restricted, non-administrative environment with minimal filesystem access, no unnecessary credentials, and limited network permissions. 7. Use automated dependency scanning and release-integrity verification, and review package ownership, provenance, and source changes before accepting upgrades. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README promotes injecting extracted video frames directly into an LLM context but does not warn that frames may contain sensitive visual information such as faces, screens, documents, or regulated data. This is dangerous because users may assume local frame extraction is privacy-safe while the resulting images are still disclosed to the model provider or downstream systems handling the prompt context.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The planned audio transcription feature mentions a local Whisper path or an API path without warning that API transcription may transmit audio content to a third party. In this skill context, that omission is meaningful because users may process private conversations, meetings, or regulated recordings and inadvertently send them off-host.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding
Using `npx clawhub@latest install see-video` pulls and executes the latest published package version at install time, which is a supply-chain risk because a compromised or malicious new release would be trusted automatically. In a skill installation context, this is more dangerous because users are encouraged to run the command directly from documentation, often without reviewing package contents first.

Unpinned Dependencies

Low
Category
Supply Chain
Content
{
  "type": "module",
  "dependencies": {
    "llm-frames": "^0.2.2"
  }
}
Confidence
93% confidence
Finding
The dependency is version-ranged with a caret (^0.2.2), allowing installs to float to newer compatible releases rather than a single audited artifact. That creates supply-chain risk: a future compromised or buggy release of llm-frames could be pulled in without code changes, which is somewhat more sensitive here because the package processes user-supplied video content in a multimodal skill path.

Static analysis

No suspicious patterns detected.