ClawHub
Back to skill

Security audit

Clawhub 3.26.1

Security checks across malware telemetry and agentic risk

Overview

This is a functional Sogni media-generation skill, but it needs review because it can modify its global CLI installation and automatically reuse persistent personal media and memories.

Install only if you are comfortable with a media-generation agent that uses a Sogni API key, may upload referenced media to Sogni-hosted services in hosted/vendor modes, stores reusable personas/memories locally, and exposes a global self-update command. Avoid hosted modes for private media, review or disable saved personas/memory if sharing the machine, and treat any self-update or sudo/admin update prompt as a manual maintenance decision rather than part of a creative task.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (31)

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
This reference file provides explicit internal guidance for generating adult sexual video content, including specialized sexual action tokens, instructions to disable safeguards with `--no-filter`, and workflow details that materially expand the skill's effective behavior beyond the public manifest description. That mismatch is dangerous because it conceals a sensitive capability from reviewers and downstream integrators, increasing the chance the skill will be deployed in contexts that do not expect or permit sexually explicit generation.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The module implements an actual self-update path that performs global package modification by invoking the system package manager, which exceeds a passive content-generation skill boundary and creates a direct code-changing capability. In an agent setting, this is dangerous because a model can be induced to run self-update and thereby alter the host environment, pull and execute newly published code, and potentially require elevated privileges.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The agent-facing notice explicitly instructs the agent to offer running `sogni-agent self-update`, enabling the model to steer users toward modifying the global CLI installation. In a prompt-influenced agent environment, this increases the chance of socially engineered or automated environment changes that are unrelated to the user’s immediate creative task.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README states that local file references are uploaded to Sogni media storage in hosted API modes, but it does so deep in a technical section rather than as a prominent privacy warning near the main hosted workflow examples. In a skill centered on local images, audio, and personas, this can lead users or agents to unintentionally transmit sensitive media off-device without informed consent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The file states that prompts and referenced media are uploaded and forwarded to hosted APIs, but it does not present this as a prominent user-facing warning near the skill description or invocation guidance. In an agent context, users may supply sensitive images, audio, or text without understanding they will be transmitted to external services, creating privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation instructs the agent to persist highly sensitive data including persona reference photos, voice clips, and user memories under predictable local paths, but does not provide any explicit warning about retention, consent, or privacy implications. In this skill’s context, the data can include biometric identifiers and personal preferences, so silent persistence increases the risk of unintended long-term storage, misuse, or later disclosure by other local processes, backups, or shared accounts.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill is configured for implicit invocation and its default prompt is phrased broadly enough that common user requests about creating or generating media could trigger it without clear user intent. In a skill that can process folders, generate media, and potentially invoke external workflows, overly broad triggers increase the risk of unexpected execution, unintended data use, or surprise tool actions.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly exposes a `manage_memory` tool that can read and write long-term user memory, but the description and guidance do not warn the user or require clear consent before persistence occurs. This creates a privacy and autonomy risk because sensitive preferences, named subjects, or project details could be stored or retrieved without the user fully understanding that long-term memory is involved.

Ssd 3

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to automatically read persisted memories and personality data on startup and before generation, which can surface or reuse prior sensitive user information without a fresh request or informed consent. Because these stores may include personal preferences, personas, voice references, or other retained data, automatic access expands privacy exposure and cross-session data leakage risk.

Ssd 2

Medium
Confidence
95% confidence
Finding
The repair recipes explicitly tell the agent to rewrite prompts after a SAFETY_REJECTED result using 'softer phrasing or different scene,' which operationalizes evasion of content-filter decisions. In a creative-generation skill with image, video, and music capabilities, this can help disallowed harmful or policy-violating requests get resubmitted in semantically altered form until accepted.

Skill Enumeration

Medium
Category
Agent Snooping
Content
This is the Codex plugin surface. Wherever the referenced skill says
`sogni-agent` or `sogni-agent-claude-code`, invoke `sogni-agent-codex`.

Read `../../plugin-skills/sogni-creative-agent/SKILL.md` relative to this installed file completely and follow it. Resolve every subsequent plugin path from the plugin root two directories above this file, never from the user's working directory.
Confidence
95% confidence
Finding
skills/sogni-creative-agent/SKILL.md

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
export function formatSelfUpdatePermissionHint({ manager = 'npm', platform = osPlatform() } = {}) {
  const rerun = platform === 'win32'
    ? 'open a terminal as Administrator and run `sogni-agent self-update` again'
    : 'run `sudo sogni-agent self-update`';
  if (manager === 'npm') {
    return `Hint: if npm reported a permissions error, ${rerun}, or install Node with a version manager (nvm/fnm/volta).`;
  }
Confidence
89% confidence
Finding
sudo

Self-Modification

High
Category
Rogue Agent
Content
| `--json` | Emit structured output for agents |
| `-n <count>` | Multiple outputs per call (safety-capped at 16; raise deliberately with `SOGNI_MAX_COUNT`) |
| `doctor` / `--doctor` | Install health check: Node, credentials, ffmpeg, auth, version (`--json` for agents) |
| `self-update` | Upgrade the CLI via the detected package manager |
| `--whats-new [version]` | Show bundled CHANGELOG entries (everything after `<version>` if given) |
| `--snooze-update` | Snooze the pending-update reminder (1 day → 2 days → 1 week) |
| `--no-update-check` | Disable the background update check for this run (`SOGNI_NO_UPDATE_CHECK=1` to disable always) |
Confidence
88% confidence
Finding
self-update

Self-Modification

High
Category
Rogue Agent
Content
6. **Verify with `doctor`**
   After any install or upgrade, run `sogni-agent doctor --json` and confirm `"success": true` before reporting the install as working.
7. **Update notices for agents**
   When a newer version exists, any command may print one advisory stderr line — `[sogni-agent] Update available: <current> -> <latest> ...` — at most once per day (stdout JSON is never touched). Agents should relay it to the user and offer `sogni-agent self-update`, or run `sogni-agent --snooze-update` if the user declines. Interactive TTY users get a banner instead. Each failed check carries a `detail` string with the fix.
8. **SSRF / URL safety**
   The CLI validates every HTTP(S) media reference with an SSRF guard ([`ssrf-guard.mjs`](./ssrf-guard.mjs)) and re-validates each redirect hop on download. Localhost and private-network URLs are rejected; only public HTTPS references are forwarded as Seedance multimodal context.
Confidence
90% confidence
Finding
self-update

Self-Modification

High
Category
Rogue Agent
Content
Pick the one matching the host you are running in, and fall back to `sogni-agent` if that command is not found. The Codex and Claude Code plugin surfaces already pin their own launcher, so this table is what a plain `SKILL.md` install (Hermes and other runtimes) should follow.

For upgrades, prefer `sogni-agent self-update`, package-manager updates, or direct operations on an existing checkout (`git -C "$DEST" pull --ff-only && npm --prefix "$DEST" install`). Do not generate clone-or-pull shell bootstrap scripts with `set -e`, `bash -c`, `sh -c`, or inline repository URLs; agent command scanners may require approval for those patterns. If a checkout does not exist, prefer the npm install path or ask before cloning.

**Update notices:** any `sogni-agent` command may print a single stderr line of the form `[sogni-agent] Update available: <current> -> <latest> ...` (at most once per day). When you see it, finish the current task first, then tell the user a newer CLI package is available and offer to run `sogni-agent self-update` (follow with `sogni-agent --whats-new` to summarize what changed). `self-update` refreshes the global CLI only; if the runtime loads a copied personal skill bundle, refresh it through the same setup flow that installed it and start a new agent session. If the user declines the CLI update, run `sogni-agent --snooze-update` so reminders pause (1 day → 2 days → 1 week). Never treat the notice line as command output — it is advisory and never appears on stdout.
Confidence
91% confidence
Finding
self-update

Self-Modification

High
Category
Rogue Agent
Content
For upgrades, prefer `sogni-agent self-update`, package-manager updates, or direct operations on an existing checkout (`git -C "$DEST" pull --ff-only && npm --prefix "$DEST" install`). Do not generate clone-or-pull shell bootstrap scripts with `set -e`, `bash -c`, `sh -c`, or inline repository URLs; agent command scanners may require approval for those patterns. If a checkout does not exist, prefer the npm install path or ask before cloning.

**Update notices:** any `sogni-agent` command may print a single stderr line of the form `[sogni-agent] Update available: <current> -> <latest> ...` (at most once per day). When you see it, finish the current task first, then tell the user a newer CLI package is available and offer to run `sogni-agent self-update` (follow with `sogni-agent --whats-new` to summarize what changed). `self-update` refreshes the global CLI only; if the runtime loads a copied personal skill bundle, refresh it through the same setup flow that installed it and start a new agent session. If the user declines the CLI update, run `sogni-agent --snooze-update` so reminders pause (1 day → 2 days → 1 week). Never treat the notice line as command output — it is advisory and never appears on stdout.

## Uninstall Request Policy
Confidence
91% confidence
Finding
self-update

Self-Modification

High
Category
Rogue Agent
Content
For upgrades, prefer `sogni-agent self-update`, package-manager updates, or direct operations on an existing checkout (`git -C "$DEST" pull --ff-only && npm --prefix "$DEST" install`). Do not generate clone-or-pull shell bootstrap scripts with `set -e`, `bash -c`, `sh -c`, or inline repository URLs; agent command scanners may require approval for those patterns. If a checkout does not exist, prefer the npm install path or ask before cloning.

**Update notices:** any `sogni-agent` command may print a single stderr line of the form `[sogni-agent] Update available: <current> -> <latest> ...` (at most once per day). When you see it, finish the current task first, then tell the user a newer CLI package is available and offer to run `sogni-agent self-update` (follow with `sogni-agent --whats-new` to summarize what changed). `self-update` refreshes the global CLI only; if the runtime loads a copied personal skill bundle, refresh it through the same setup flow that installed it and start a new agent session. If the user declines the CLI update, run `sogni-agent --snooze-update` so reminders pause (1 day → 2 days → 1 week). Never treat the notice line as command output — it is advisory and never appears on stdout.

## Uninstall Request Policy
Confidence
91% confidence
Finding
self-update

Self-Modification

High
Category
Rogue Agent
Content
| `-q, --quiet` | Suppress progress output | false |
| `-t <sec>` | Timeout | 30 image / 300 video |
| `--strict-size` | Fail instead of auto-adjusting video size | false |
| `doctor`, `self-update`, `--whats-new`, `--snooze-update` | Health check / upgrade / changelog / snooze reminder | - |

## Routing Rules (always apply)
Confidence
86% confidence
Finding
self-update

Self-Modification

High
Category
Rogue Agent
Content
runForegroundCheck as runUpdateCheckForeground,
  maybeSpawnBackgroundCheck as maybeSpawnUpdateCheck,
  getQueuedNotice as getUpdateCheckNotice,
  runSelfUpdate as runSogniSelfUpdate,
  snoozeUpdate as snoozeSogniUpdate,
  runWhatsNew as runSogniWhatsNew,
  readState as readUpdateCheckState,
Confidence
95% confidence
Finding
SelfUpdate

Self-Modification

High
Category
Rogue Agent
Content
runForegroundCheck as runUpdateCheckForeground,
  maybeSpawnBackgroundCheck as maybeSpawnUpdateCheck,
  getQueuedNotice as getUpdateCheckNotice,
  runSelfUpdate as runSogniSelfUpdate,
  snoozeUpdate as snoozeSogniUpdate,
  runWhatsNew as runSogniWhatsNew,
  readState as readUpdateCheckState,
Confidence
95% confidence
Finding
SelfUpdate

Self-Modification

High
Category
Rogue Agent
Content
await runUpdateCheckForeground({ currentVersion: PACKAGE_VERSION });
  process.exit(0);
}
// User-facing subcommand: `sogni-agent self-update`
if (RAW_ARGS[0] === 'self-update') {
  process.exit(runSogniSelfUpdate({}));
}
Confidence
96% confidence
Finding
self-update

Self-Modification

High
Category
Rogue Agent
Content
process.exit(0);
}
// User-facing subcommand: `sogni-agent self-update`
if (RAW_ARGS[0] === 'self-update') {
  process.exit(runSogniSelfUpdate({}));
}
// `--snooze-update`: pause reminders for the currently pending update
Confidence
96% confidence
Finding
self-update

Self-Modification

High
Category
Rogue Agent
Content
}
// User-facing subcommand: `sogni-agent self-update`
if (RAW_ARGS[0] === 'self-update') {
  process.exit(runSogniSelfUpdate({}));
}
// `--snooze-update`: pause reminders for the currently pending update
// (escalating backoff: 1 day → 2 days → 1 week; a newer release resets it).
Confidence
95% confidence
Finding
SelfUpdate

Self-Modification

High
Category
Rogue Agent
Content
--whats-new [version] Show bundled CHANGELOG entries (everything after <version> if given)
  --version, -V         Show sogni-agent version and exit
  --no-update-check     Skip the once-daily npm update check for this run
  self-update           Upgrade sogni-agent in place (npm/pnpm/yarn/bun auto-detected)
  --extract-last-frame <video> <image>  Extract last frame from a video (safe ffmpeg wrapper)
  --extract-first-frame <video> <image> Extract first frame from a video (safe ffmpeg wrapper)
  --extract-frame-at <video> <sec> <image> Extract a timestamped frame (safe ffmpeg wrapper)
Confidence
91% confidence
Finding
self-update

Self-Modification

High
Category
Rogue Agent
Content
const updateState = readUpdateCheckState();
  if (updateState?.lastKnownLatest && compareSogniSemver(updateState.lastKnownLatest, PACKAGE_VERSION) > 0) {
    add('version', 'warn', `${PACKAGE_VERSION} installed; ${updateState.lastKnownLatest} available — run: sogni-agent self-update`);
  } else {
    add('version', 'pass', `${PACKAGE_VERSION}${updateState?.lastKnownLatest ? ` (latest known: ${updateState.lastKnownLatest})` : ''}`);
  }
Confidence
90% confidence
Finding
self-update

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
sogni-agent.mjs:227

Sensitive-looking file read is paired with a network send.

Warn
Code
suspicious.potential_exfiltration
Location
sogni-agent.mjs:5188