ClawHub
Back to skill

Security audit

LrshuAI First Tail Frame To Video

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to generate videos as advertised, but it forces direct Python execution and sends credentials plus selected media to a configurable remote endpoint without enough scoping.

Review before installing. Use this only if you trust the dlazy.com service or your configured TEAM_BASE_URL, are comfortable uploading the selected prompts/images/videos, and can provide a scoped TEAM_API_KEY. Confirm TEAM_BASE_URL is unset or points to the intended provider before use, and avoid using sensitive media unless the provider's handling and retention are acceptable.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'endpoint' from os.getenv (line 39, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
print(f"Invoking model: {args.model} ...")
    try:
        response = requests.post(endpoint, headers=headers, json=payload)
        response.raise_for_status()
        result = response.json()
Confidence
95% confidence
Finding
The script sends an Authorization bearer token plus user prompt and optional base64-encoded local media to a network endpoint derived from TEAM_BASE_URL without validating or restricting the destination. If that environment variable is changed to an attacker-controlled host, the skill will exfiltrate credentials and potentially sensitive local file contents.

Tainted flow: 'poll_endpoint' from os.getenv (line 143, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
while True:
            time.sleep(3) # 每3秒查询一次
            poll_resp = requests.get(poll_endpoint, headers=headers)
            poll_resp.raise_for_status()
            poll_data = poll_resp.json()
Confidence
92% confidence
Finding
The polling GET request reuses the attacker-influenced base URL and Authorization header, extending the same exfiltration and SSRF risk beyond the initial submission. Because generateId is appended into the query string and the loop continues until completion, a malicious endpoint can keep the client contacting an arbitrary host indefinitely while receiving authenticated traffic.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill invokes a local Python script and requires an API key, which implies code execution, environment access, and likely outbound network access, yet no explicit permissions are declared. This weakens the platform's trust and review model because an agent or reviewer may underestimate what the skill can access or transmit, especially when handling user-supplied file paths and remote model calls.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill is presented as a narrow first/last-frame video generator, but the documented behavior indicates a broader wrapper around multiple remote models that may accept text-only prompts, single-image inputs, video inputs, and remote URLs. This mismatch is dangerous because it can bypass user and agent expectations, enabling broader data exfiltration, unreviewed network fetches, or unintended model operations under the guise of a constrained media skill.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill uploads prompt text and optional local image/video contents to a remote API, but the CLI does not present a clear affirmative warning or consent step before transmitting potentially sensitive local data. In this skill context, users may assume it only processes provided frames for video generation, so silent remote upload increases privacy and data-handling risk.

Static analysis

No suspicious patterns detected.