ClawHub
Back to skill

Security audit

直播自动识别高光时刻切片

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to only process local video files into highlight clips, with a dependency-locking caution before installation.

Install in an isolated Python environment, consider pinning or locking dependencies before production use, and choose an output directory where generated clip names and merged_highlights.mp4 may be safely written or overwritten.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Unpinned and Unverified Third-Party Dependencies

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1-3 and README.md:13-18
Vulnerability Type: Third-party dependency supply-chain risk
Risk Level: Low

Vulnerable Code

requirements.txt:1-3:

text
librosa>=0.10.0
numpy>=1.24.0
pydub>=0.25.1

README.md:13-18:

markdown
- Python packages:

```bash
python3 -m pip install -r requirements.txt
text

### Technical Analysis

The dependency manifest specifies only minimum versions and does not impose upper bounds, pin exact reviewed releases, or verify package artifacts with cryptographic hashes. Consequently, the documented installation command can resolve and install future package versions that were not reviewed with this project.

Python package installation may execute package build or installation logic. If a permitted package release, one of its transitive dependencies, or the configured package index is compromised, following the documented installation procedure could introduce and execute attacker-controlled code.

The declared `pydub` dependency is not imported by `scripts/highlight_slicer.py`, so it unnecessarily expands the dependency and transitive supply-chain attack surface.

### Attack Path

1. An attacker compromises a permitted future release of a declared dependency, one of its transitive dependencies, or the package source used by pip.
2. A user follows the installation instructions and runs `python3 -m pip install -r requirements.txt`.
3. Because the requirements accept any version at or above the stated minimum and contain no artifact hashes, pip resolves the compromised or otherwise unreviewed release.
4. Malicious build or installation code executes with the privileges of the user running pip, or malicious runtime code executes when the Skill imports the affected package.
5. The attacker gains access to resources available to that user and process.

### Impact Assessment

Successful exploitation could execute arbitrary code with the privileges 
...[truncated 539 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove pydub if it is not required by the implementation.
  2. Pin every direct dependency to an exact, reviewed version.
  3. Generate a lock file that includes all transitive dependencies.
  4. Require cryptographic hashes during installation, such as with a hash-locked requirements file and pip's --require-hashes option.
  5. Install packages only from an explicitly trusted package index.
  6. Use automated dependency vulnerability and integrity scanning.
  7. Review and deliberately update locked dependencies on a controlled schedule rather than accepting future releases automatically.
  8. Perform installation in an isolated virtual environment with minimal privileges.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
给定本地直播录屏文件路径，使用音频能量、场景变化、音画混合、音画并集或 ASR 关键词密集度识别高光时间段，并输出多个短视频片段；可选再合并为一个高光合集视频。核心脚本为 `scripts/highlight_slicer.py`。

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code uses Chinese-only natural-language strings for argument errors and CLI descriptions, and that pattern continues throughout the script. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/highlight_slicer.py (reported line 161)May include surrounding context.

python
"default=noprint_wrappers=1:nokey=1",
        str(video_path),
    ]
    result = subprocess.run(command, capture_output=True, text=True)
    if result.returncode != 0:
        fail(f"ffprobe 获取时长失败: {result.stderr.strip() or result.stdout.strip()}", EXIT_AUDIO_EXTRACT)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/highlight_slicer.py (reported line 222)May include surrounding context.

python
"default=noprint_wrappers=1:nokey=1",
        str(video_path),
    ]
    result = subprocess.run(command, capture_output=True, text=True)
    if result.returncode != 0:
        fail(f"ffprobe 获取时长失败: {result.stderr.strip() or result.stdout.strip()}", EXIT_AUDIO_EXTRACT)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/highlight_slicer.py (reported line 290)May include surrounding context.

python
"default=noprint_wrappers=1:nokey=1",
        str(video_path),
    ]
    result = subprocess.run(command, capture_output=True, text=True)
    if result.returncode != 0:
        fail(f"ffprobe 获取时长失败: {result.stderr.strip() or result.stdout.strip()}", EXIT_AUDIO_EXTRACT)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/highlight_slicer.py (reported line 527)May include surrounding context.

python
"default=noprint_wrappers=1:nokey=1",
        str(video_path),
    ]
    result = subprocess.run(command, capture_output=True, text=True)
    if result.returncode != 0:
        fail(f"ffprobe 获取时长失败: {result.stderr.strip() or result.stdout.strip()}", EXIT_AUDIO_EXTRACT)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/highlight_slicer.py (reported line 590)May include surrounding context.

python
"copy",
        str(merged_path),
    ]
    result = subprocess.run(command, capture_output=True, text=True, cwd=output_dir)
    if result.returncode != 0:
        log("WARN", "无损 concat 合并失败，回退到重新编码合并")
        fallback = [

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency specification uses a lower-bound version constraint instead of pinning an exact version, which makes builds non-reproducible and can result in different packages being installed over time. This increases supply-chain risk because a vulnerable or malicious newly released version could be pulled into the environment without review.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
librosa>=0.10.0
numpy>=1.24.0
pydub>=0.25.1

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

numpy>=1.24.0 is not pinned to a specific version, so installations may resolve to different releases depending on when and where the skill is installed. This weakens reproducibility and makes it harder to verify whether the deployed package includes security fixes or introduces known-vulnerable versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
librosa>=0.10.0
numpy>=1.24.0
pydub>=0.25.1

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The manifest references numpy without pinning to a specific release, and numpy has multiple published advisories across its version history. Because the installed version is not fixed, it is impossible to determine from this file alone whether deployment will use a vulnerable release, creating uncertainty and avoidable exposure.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

pydub>=0.25.1 allows any later version to be installed, which can unintentionally introduce breaking or unsafe releases into the environment. While not an immediate exploit by itself, this is a real supply-chain hygiene issue that raises exposure to dependency compromise or vulnerable updates.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
librosa>=0.10.0
numpy>=1.24.0
pydub>=0.25.1