Video Processor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:27 AM UTC
• Version: 1.1.0

Overview

The skill appears to be a simple video-processing helper, but its install instructions rely on executing a mutable latest-version npm package.

Review the install command before using this skill. Prefer a pinned, verified clawhub installer version and avoid running the npx command with elevated privileges. The skill's visible behavior is video processing, but the current install path depends on whatever package is published as latest at install time.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: README.md:5

Finding

Mutable Third-Party Package Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 5-7
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code:

bash

npx clawhub@latest install video-processor

Technical Analysis

The documented installation command instructs users to execute the mutable latest release of the third-party clawhub package through npx. Because neither an exact version nor an integrity hash is specified, the code executed by this command can change after this project has been reviewed.

Depending on the local npm configuration, npx can download the selected package and execute its CLI code. Package lifecycle scripts or the invoked installer may consequently run arbitrary commands. The repository does not contain the installer implementation, a lockfile, an integrity record, or other controls that would allow the retrieved package to be verified against an audited release.

Attack Path

1. An attacker compromises the upstream clawhub package, its publisher account, or the package distribution channel.
2. The attacker publishes a malicious release selected by the latest tag.
3. A user follows the installation instructions and runs npx clawhub@latest install video-processor.
4. npx retrieves the attacker-controlled release and invokes its executable code.
5. The malicious package executes commands under the privileges of the user running the installation.

This exploitation path depends on compromise or malicious modification of the external dependency; the audited repository itself does not contain a remote payload.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the permissions of the installing user. Potential impact includes reading or modifying files accessible to that account, accessing environment variables and developer credentials, altering local project data, initiating network connections, and insta ...[truncated 160 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mutable @latest reference with an exact, reviewed package version.
• Verify the selected release and document the expected package integrity hash.
• Use a lockfile or another reproducible dependency mechanism where supported.
• Configure and document the trusted package registry rather than relying on implicit npm configuration.
• Review the package contents, executable entry point, and lifecycle scripts before recommending execution.
• Prefer installing the verified package first and invoking it separately instead of allowing npx to download and execute an unresolved release automatically.
• Update dependencies through a controlled review process rather than following a moving distribution tag.
• Advise users not to run the installation command with administrative or root privileges.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to run npx clawhub@latest install video-processor, which fetches and executes the latest published package version at install time rather than a pinned, reviewed version. If the upstream package is compromised or a breaking/malicious release is published, users could execute untrusted code during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description is presented in Chinese ('视频处理工具集。') with no indication that users may choose another language or locale. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description and user-facing documentation are written entirely in Chinese, which imposes a specific language on users without any stated opt-in or alternative locale. The policy for this category requires flagging language or locale constraints when the skill does not explicitly offer a choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.