ClawHub
Back to skill

Security audit

Create Edu Video

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed educational-video workflow with expected setup and rendering commands, with dependency and language-default cautions but no hidden persistence, credential access, exfiltration, or destructive behavior.

Install only in a disposable or project-specific workspace, review the companion remotion-video-toolkit skill before allowing it, and consider pinning npm package versions before running pnpm create or pnpm add. Expect Chinese defaults unless you specify another voice or language.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:27
Finding

Execution of Unpinned Third-Party Packages and Skill Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

声明描述的是一个端到端教学视频制作技能，核心能力应包括内容生成、配音、视觉设计、视频代码生成和最终导出。而提供的代码只是一个字幕后处理工具，用于把现有 SRT 时间轴按现有音频总时长进行同步。它不生成教学内容、不生成视频、不处理课程主题，也没有任何 Remotion、视频渲染、画面制作或导出逻辑。虽然“教学视频制作”流程中可能会用到字幕同步作为辅助步骤，但该代码片段的主要用途与声明的主要用途存在明显且实质性的偏差，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill instructs the agent to use shell commands, read local references, and create or modify project files, but it declares no explicit tool scope or permission boundaries. That makes the effective authority ambiguous and can allow broader-than-expected execution if the hosting platform auto-grants shell/file capabilities, increasing the blast radius of mistakes or prompt-injection-driven actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger description is broad enough that normal requests about educational or explanatory content could activate a skill that uses shell, file reads, and file writes. Over-broad activation increases the chance of accidental execution in contexts where the user did not intend project creation, environment probing, or command execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

L021 的环境检查直接要求 grep zh-CN，且后续 L084、L159 默认使用 zh-CN-XiaoxiaoNeural，表现为默认固定中文语音与语言环境。文档没有说明这是用户可选项，也未提供语言/locale 选择机制，构成语言/地区策略风险。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code file contains user-facing natural language in the module docstring and argument help text that assumes a Chinese locale. The policy calls for flagging language or locale constraints when a specific language is forced without user opt-in, and this script offers no alternative language or selection mechanism.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/sync_srt_tts.py (reported line 82)May include surrounding context.

python
"default=noprint_wrappers=1:nokey=1",
        audio_path,
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    if result.returncode != 0:
        raise RuntimeError(f"ffprobe failed: {result.stderr}")
    return float(result.stdout.strip())

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file uses Chinese throughout, beginning with the title at L001, and does not indicate that users may choose another language or that the content is intentionally limited to a Chinese-speaking audience. Under the policy rule for language or locale constraints, forcing a single language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.