ClawHub
Back to skill

Security audit

抖音/tiktok直播录制并发布

Security checks for vulnerabilities and agentic risk

Overview

This skill locally analyzes livestream recordings and writes highlight clips, with no evidence of network transfer, credential use, persistence, or hidden behavior.

Install only if you are comfortable letting the skill run ffmpeg/ffprobe on local videos and write clips plus metadata into an output directory. Use a dedicated output folder, avoid running it on untrusted media in sensitive terminals, and review generated files before publishing them.

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill documentation describes capabilities to read local files, write output files, and invoke shell-accessible tools like ffmpeg/ffprobe, but no corresponding permissions are declared. This creates a trust and containment gap: an agent or reviewer may treat the skill as less privileged than it really is, while the actual workflow operates on arbitrary local paths and external command execution.

Unvalidated Output Injection

High
Category
Output Handling
Content
"default=noprint_wrappers=1:nokey=1",
        str(video_path),
    ]
    result = subprocess.run(command, capture_output=True, text=True)
    if result.returncode != 0:
        fail(f"ffprobe 获取时长失败: {result.stderr.strip() or result.stdout.strip()}", EXIT_AUDIO_EXTRACT)
Confidence
72% confidence
Finding
The script directly includes ffprobe stderr/stdout in error messages, and those outputs should be treated as untrusted because they may reflect attacker-controlled filenames or malformed media metadata. In terminal, log, or UI contexts this can enable output injection such as ANSI escape sequences, log forging, or misleading operator-visible messages.

Unvalidated Output Injection

High
Category
Output Handling
Content
"pcm_s16le",
        str(wav_path),
    ]
    result = subprocess.run(command, capture_output=True, text=True)
    if result.returncode != 0:
        fail(f"音频提取失败: {result.stderr.strip() or result.stdout.strip()}", EXIT_AUDIO_EXTRACT)
    log("OK", f"音频提取完成: {wav_path}")
Confidence
74% confidence
Finding
Raw ffmpeg output is interpolated into failure messages without sanitization, so a crafted input file or filename can influence terminal/log output. This is usually not code execution, but it can manipulate operator-visible output, poison logs, or obscure the real cause of failure.

Unvalidated Output Injection

High
Category
Output Handling
Content
log("STEP", f"执行场景变化检测，阈值: {scene_threshold}")
    filter_expr = f"select='gt(scene,{scene_threshold})',showinfo"
    command = ["ffmpeg", "-i", str(video_path), "-filter:v", filter_expr, "-f", "null", "-"]
    result = subprocess.run(command, capture_output=True, text=True)

    if result.returncode != 0 and not result.stderr:
        fail("场景检测执行失败", EXIT_AUDIO_EXTRACT)
Confidence
70% confidence
Finding
This ffmpeg invocation captures stderr from processing attacker-supplied media and later uses that data for logic and potential messaging, without sanitization. In environments where logs or terminals are consumed by humans or downstream systems, malicious escape/control sequences can lead to output injection or log pollution.

Unvalidated Output Injection

High
Category
Output Handling
Content
def run_ffmpeg(command: List[str], error_prefix: str) -> None:
    result = subprocess.run(command, capture_output=True, text=True)
    if result.returncode != 0:
        fail(f"{error_prefix}: {result.stderr.strip() or result.stdout.strip()}", EXIT_AUDIO_EXTRACT)
Confidence
76% confidence
Finding
The helper prints raw stderr/stdout from arbitrary ffmpeg commands on failure, creating a reusable sink for untrusted subprocess output. If hostile media or filenames influence ffmpeg diagnostics, they can inject deceptive content into logs or terminal sessions.

Unvalidated Output Injection

High
Category
Output Handling
Content
"copy",
        str(merged_path),
    ]
    result = subprocess.run(command, capture_output=True, text=True, cwd=output_dir)
    if result.returncode != 0:
        log("WARN", "无损 concat 合并失败，回退到重新编码合并")
        fallback = [
Confidence
64% confidence
Finding
The merge path captures ffmpeg output and uses it in control flow and fallback behavior, and the same raw-output handling pattern exists in this area. Because filenames and media characteristics can affect ffmpeg diagnostics, unsanitized output can still cause terminal/log injection even though command injection is not present.

Static analysis

No suspicious patterns detected.