ClawHub
Back to skill

Security audit

Video Crawler

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it includes an unrelated embedded API key that users should not inherit or redistribute.

Review before installing. The maintainer should remove the embedded API key, rotate it, and republish. Use a virtual environment or container, avoid running installs as an administrator, restrict outbound network access if possible, and only provide trusted video URLs and output paths.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
video_crawler.py:16
Finding

Hard-Coded DashScope API Credential in Source Code

Content
View full analysis

Vulnerability Details

File Location: video_crawler.py, line 16
Vulnerability Type: Hard-coded secret
Risk Level: High

Vulnerable Code

python
DASHSCOPE_API_KEY = "sk-c0f66bb7aeff4b94810691214a1477fd"

Technical Analysis

The source code contains a credential-shaped DashScope API key in plaintext. Any person or system with access to the project package, source repository, build artifacts, backups, or logs containing this file can recover the value without authentication.

The credential is not used elsewhere in the reviewed script, so it is unnecessary for the documented video-download functionality. Its presence therefore expands the project's exposure without providing a functional benefit. Whether the credential remains active cannot be established through static analysis, but it must be treated as compromised because it has been distributed in plaintext.

Attack Path

  1. An attacker obtains a copy of the skill package, repository, archive, or related build artifact.
  2. The attacker reads video_crawler.py and extracts the value assigned to DASHSCOPE_API_KEY.
  3. The attacker submits the key to compatible DashScope API endpoints.
  4. If the key is active, the attacker consumes the associated account's API quota or accesses capabilities granted to that credential.

Impact Assessment

A valid key could permit unauthorized use of the associated DashScope account within the credential's assigned permissions and quotas. Potential consequences include unexpected charges, quota depletion, service disruption, and access to API functionality available to the key. This finding does not provide local operating-system privileges by itself; its scope is limited to the external account and permissions represented by the credential.

Remediation
View remediation

Remediation Suggestions

  1. Revoke or rotate the exposed key immediately and review the associated account's usage logs for unauthorized activity.
  2. Remove the credential from the current source and all accessible repository history, release archives, caches, and build artifacts.
  3. Because the key is unused, delete the variable entirely. If a future feature legitimately requires a secret, retrieve it from a protected environment variable or managed secret store.
  4. Apply least-privilege scopes, spending limits, quota alerts, expiration, and credential rotation policies.
  5. Add automated secret scanning to pre-commit hooks and continuous-integration pipelines to prevent recurrence.

T09 · Insecure Skill Coding Practices

Warning
Location
video_crawler.py:98
Finding

Unrestricted URL Processing in Twitter Download Mode

Content
View full analysis

Vulnerability Details

File Location: video_crawler.py, lines 98-104
Vulnerability Type: Missing URL allowlist and outbound-request validation
Risk Level: Medium

Vulnerable Code

python
if not output_file:
    output_file = "/tmp/twitter_video.mp4"

cmd = ["yt-dlp", "-o", output_file, "--no-warnings", url]

try:
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)

Technical Analysis

The command-line interface describes this execution branch as a Twitter downloader, but the user-controlled url is passed directly to the network-capable yt-dlp program without validating its scheme, hostname, port, or resolved destination.

Use of an argument array prevents conventional shell metacharacter injection because shell=True is not enabled. The issue is instead excessive network capability: yt-dlp supports many websites and generic URL handling, so the application's claimed Twitter-only boundary is not enforced. If this script is exposed through an agent, bot, API, or other service that accepts untrusted requests, an attacker may induce outbound connections to unintended destinations reachable from the execution environment.

Redirect behavior also needs enforcement. Validation of only the initial URL would be insufficient if an allowed host can redirect the downloader to a disallowed, local, private, or link-local address.

Attack Path

  1. An attacker invokes the skill with twitter as the platform while supplying a URL that does not belong to an approved Twitter or X host.
  2. main() forwards the supplied value to download_twitter().
  3. The function places the unmodified URL into the yt-dlp argument list.
  4. yt-dlp attempts to resolve and access that destination using the host's network connectivity.
  5. If the execution environment can reach destinations unavailable to the attacker, this behavior can be used for unauthorized outbound requests or ne ...[truncated 544 chars]
Remediation
View remediation

Remediation Suggestions

  1. Parse the URL with a standards-compliant URL parser before invoking yt-dlp.
  2. Require HTTPS and allow only exact approved hostnames, such as x.com, www.x.com, twitter.com, and www.twitter.com, plus any explicitly reviewed media hosts required for operation.
  3. Reject embedded credentials, unexpected ports, malformed hostnames, and ambiguous hostname forms.
  4. Resolve the hostname and reject loopback, private, link-local, multicast, reserved, and otherwise non-public IP addresses for both IPv4 and IPv6.
  5. Enforce the same policy after every redirect and protect against DNS rebinding.
  6. Run the downloader in a restricted environment with outbound firewall rules limited to required domains, low filesystem privileges, download-size limits, and execution timeouts.
  7. Continue using an argument array without shell=True; do not replace it with a shell command string.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned Third-Party Dependencies and Browser Artifacts

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8-9
Vulnerability Type: Unpinned supply-chain dependencies
Risk Level: Medium

Vulnerable Code

bash
pip install playwright requests yt-dlp
playwright install chromium

Technical Analysis

The installation instructions retrieve the latest versions available at installation time without a version lockfile or integrity hashes. The Chromium artifact installed by Playwright is likewise selected according to the resolved Playwright release rather than a reviewed project lock.

Consequently, two users following the same instructions at different times may install different code. A malicious, compromised, or unexpectedly incompatible future release could be introduced without any change to this project being reviewed. Python packages and browser installation tooling execute code in the installation or runtime environment, making dependency integrity security-sensitive.

The reviewed package names do not appear to be obvious typosquats, and the audit found no direct evidence that the current upstream packages are malicious. The risk arises from mutable and unverifiable dependency resolution.

Attack Path

  1. A maintainer or user follows the documented installation commands.
  2. The package manager resolves whatever versions are current at that time.
  3. If an upstream account, package release, package index, distribution artifact, or dependency is compromised, the affected release is downloaded without being blocked by a project version lock or expected hash.
  4. Installation hooks or imported runtime code execute with the permissions of the user running the skill.
  5. The compromised component can access files, credentials, and network resources available to that process.

Impact Assessment

A compromised dependency could execute arbitrary code with the privileges of the installing or executing user. The resulting scope could include theft or ...[truncated 295 chars]

Remediation
View remediation

Remediation Suggestions

  1. Define reviewed, exact dependency versions in a requirements or lock file.
  2. Generate and verify cryptographic hashes for Python distributions, using hash-enforced installation where practical.
  3. Pin and document the expected Playwright and Chromium revisions so installations are reproducible.
  4. Use trusted package indexes and explicitly configured artifact sources rather than uncontrolled mirrors.
  5. Run dependency vulnerability, provenance, and license checks in continuous integration.
  6. Update dependencies through a controlled review process that tests each proposed version before release.
  7. Install dependencies in an isolated virtual environment or container as a non-administrative user.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

A hardcoded DashScope API key is embedded directly in source code even though the tool's stated purpose is only video crawling/downloading, making the credential unnecessary and highly suspicious. Anyone who can read the file can extract and abuse the key for unauthorized API usage, billing fraud, or access to associated account resources.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The source contains a hardcoded API credential without any disclosure, warning, or secure handling controls, increasing the likelihood of accidental leakage through repositories, logs, or redistribution. In a user-facing skill, silently embedding secrets is dangerous because downstream users may unknowingly inherit and expose someone else's credential.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The natural-language content of the skill is entirely in Chinese, including the title, usage guidance, and notes, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking context. Under the stated policy, forcing a specific language without user opt-in is a language/locale policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · video_crawler.py (reported line 105)May include surrounding context.

python
cmd = ["yt-dlp", "-o", output_file, "--no-warnings", url]
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
        if result.returncode == 0:
            return output_file
    except Exception as e:

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly instructs users to fetch remote video content and save it locally, but the documentation provides no warning about storage usage, untrusted remote media, or the fact that external content will be written to disk. This can lead to unsafe use in constrained or sensitive environments where downloading arbitrary remote files may violate policy or create operational risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The module docstring and all user-facing CLI messages are written only in Chinese, which imposes a specific language on users without any opt-in or alternative. This is a natural-language policy concern because the skill does not provide a language or locale choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.