ClawHub
Back to skill

Security audit

LrshuAI Image To Video

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real remote video-generation skill, but it sends prompts, media, and an API token to a configurable endpoint with weak disclosure and scoping.

Install only if you trust the provider behind TEAM_BASE_URL and are comfortable sending prompts plus selected image or video files to that service using TEAM_API_KEY. Verify the endpoint before use, avoid sensitive or proprietary media, and prefer a version that documents its remote data handling and uses a constrained execution path.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tainted flow: 'endpoint' from os.getenv (line 39, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
print(f"Invoking model: {args.model} ...")
    try:
        response = requests.post(endpoint, headers=headers, json=payload)
        response.raise_for_status()
        result = response.json()
Confidence
95% confidence
Finding
The request destination is derived from TEAM_BASE_URL, an environment variable, and the code sends the Authorization bearer token plus user-supplied prompt/media to that URL without validation or allowlisting. In an agent/runtime context, environment configuration is often externally controlled, so this enables exfiltration of API credentials and sensitive image/video content to an attacker-controlled server.

Tainted flow: 'poll_endpoint' from os.getenv (line 143, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
while True:
            time.sleep(3) # 每3秒查询一次
            poll_resp = requests.get(poll_endpoint, headers=headers)
            poll_resp.raise_for_status()
            poll_data = poll_resp.json()
Confidence
92% confidence
Finding
The polling URL is also derived from the same unvalidated base URL and is queried with the Authorization header repeatedly. If the base URL is malicious or redirected to an attacker-controlled endpoint, the script continuously leaks the bearer token and operational metadata during polling.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares no explicit permissions while the metadata and documented invocation require access to an environment variable API key and external network access. This under-declaration is dangerous because it hides the real trust boundary from the user and agent, making secret use and outbound data transfer less transparent.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The documented purpose says the skill generates video from an image and text description, but the behavior described by analysis is materially broader: it can send data to a remote API, accept remote URLs, and support modes beyond the stated use case. This mismatch is dangerous because users and orchestration agents may provide data under false assumptions, enabling unexpected exfiltration of media, prompts, or credentials-backed requests to third-party services.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The activation guidance is overly broad, telling the agent to invoke the skill whenever the user asks to use it, without requiring suitability checks, consent for external transmission, or validation of inputs. In context, this is more dangerous because the same file also pushes direct execution via python and the skill uses an API key and remote service, increasing the chance of unnecessary or unsafe invocation.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The markdown lacks a user-facing warning that using the skill consumes API credentials and sends prompts/media to an external model provider. This is risky because users may unknowingly expose sensitive images, prompts, or linked media to third-party infrastructure under the agent's authority.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script reads local image/video files, base64-encodes them, and transmits them to a remote API without explicit consent, warning, or clear disclosure in the invocation flow. In this skill context, users may expect media transformation, but the combination of local file access plus remote upload is still sensitive because personal or proprietary media can be silently exfiltrated to a third-party service.

Static analysis

No suspicious patterns detected.