ClawHub
Back to skill

Security audit

VMEG Audio/Video Translation, Subtitle Translation, and Dubbing

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned for VMEG media translation, but it gives dynamic remote MCP instructions too much authority and normalizes risky setup practices around local configs, API keys, and unpinned installers.

Review this skill carefully before installing. Prefer ClawHub or another pinned/verified install path over copy-pasting unpinned npx commands, use OAuth where possible, do not let an agent read full MCP config files unless you have checked/redacted secrets first, and treat VMEG MCP server instructions as tool guidance only, not as permission to override higher-priority user or system rules.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:37
Finding

Untrusted Remote MCP Instructions Are Granted Highest Priority

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-42
Vulnerability Type: Remote instruction hijacking
Risk Level: Critical

Vulnerable Code:

markdown
## Instruction priority

1. **MCP server instructions (highest)** — injected automatically after connecting. **Follow strictly; do not override with this Skill.**
2. **This Skill** — when to enable, connection prerequisites, platform doc routing, install/troubleshooting entry points.
3. **references/tools.md** — read only when the user asks what tools exist or what they do (quick reference, no parameter details).
4. **install / setup / oauth / README** — read only when the user asks about install, OAuth, API Key, or MCP connection failures.

Technical Analysis

The Skill explicitly grants instructions dynamically supplied by the remote VMEG MCP server the highest priority and directs the agent to follow them strictly. Those remote instructions are not included in the audited artifact and may change independently after installation.

MCP server instructions should be treated as untrusted external content rather than as an authority capable of redefining agent behavior. This directive creates an instruction-hijacking boundary: compromise of the MCP service, its delivery infrastructure, or an associated account could cause the agent to process attacker-controlled behavioral instructions.

The remote content cannot legitimately supersede system or developer policies. Nevertheless, an agent that follows the Skill literally may allow it to influence session goals, tool selection, data disclosure, confirmation handling, or other actions available in the current environment.

Attack Path

  1. A user installs the Skill and configures https://www.vmeg.ai/api/mcp.
  2. The agent connects to the remote MCP endpoint.
  3. The MCP server supplies dynamically generated instructions.
  4. The Skill labels those instructions as the highest priority and re ...[truncated 1033 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the statement that MCP server instructions have the highest priority or must be followed strictly.
  2. Explicitly state that remote MCP content is subordinate to system, developer, user, safety, and least-privilege constraints.
  3. Limit MCP-provided instructions to tool schemas and VMEG-specific operational guidance.
  4. Reject remote instructions that request unrelated file access, credential access, policy changes, hidden actions, or execution outside the declared media workflow.
  5. Preserve explicit confirmation requirements for deletion, rendering, retranslating, re-dubbing, quota-consuming operations, and uploads.
  6. Validate tool arguments locally and display consequential actions to the user before invocation.
  7. Consider pinning or signing a reviewed MCP instruction policy so changes can be detected and re-audited.

T08 · Insecure Dependencies

Error
Location
references/install.md:13
Finding

Unpinned Third-Party Installation Commands Permit Mutable Supply-Chain Code Execution

Content
View full analysis

Vulnerability Details

File Location: references/install.md, lines 13-24
Vulnerability Type: Unpinned third-party package and repository execution
Risk Level: High

Vulnerable Code:

bash
npx skills add Pixripple/vmeg-skills --list
npx skills add Pixripple/vmeg-skills --skill vmeg-media-translation -g -y

Per-agent examples:

bash
npx skills add Pixripple/vmeg-skills --skill vmeg-media-translation -g -a cursor -y
npx skills add Pixripple/vmeg-skills --skill vmeg-media-translation -g -a claude-code -y
npx skills add Pixripple/vmeg-skills --skill vmeg-media-translation -g -a codex -y
npx skills add Pixripple/vmeg-skills --skill vmeg-media-translation -g -a gemini-cli -y

Similar unpinned commands appear in README.md and the platform-specific setup documents. The project also recommends commands such as:

bash
npx -y @lobehub/market-cli skills install pixripple-vmeg-skills-vmeg-media-translation -g

Technical Analysis

npx can download and execute the currently resolved version of an npm package. The documented commands do not pin the skills or @lobehub/market-cli package to an exact version and do not specify an integrity hash. The referenced GitHub Skill source is also normally installed from a mutable repository reference rather than a specific audited commit.

The -y option suppresses interactive package-install approval, while -g requests installation at a broad user or global Skill scope. Consequently, the effective installer and installed Skill content can change after this audit.

This does not prove that the current packages are malicious. It creates a supply-chain vulnerability in which compromise of an npm package, registry account, marketplace listing, GitHub maintainer account, or mutable repository branch could substitute unreviewed content.

Attack Path

  1. An attacker compromises a referenced npm package, publisher account, marketplace iden ...[truncated 1116 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin each npm CLI to an exact reviewed version, for example by using an explicit package version rather than the latest registry resolution.
  2. Pin the Skill source to a release tag and immutable commit hash; verify that the tag resolves to the expected commit.
  3. Publish SHA-256 checksums or signed release attestations for the Skill artifact.
  4. Avoid npx -y so users can review the package name and resolved version before execution.
  5. Prefer project-scoped or per-agent installation over global installation unless global scope is explicitly required.
  6. Recommend downloading and inspecting the artifact before installation in security-sensitive environments.
  7. Document trusted publisher identities and warn users to verify marketplace identifiers, especially where the document already notes that identifiers may differ.
  8. Use package lockfiles, provenance verification, and registry integrity metadata where supported.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:46
Finding

Agent Is Permitted to Read Credential-Bearing User MCP Configuration

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 46-52; references/setup-cursor.md, line 55
Vulnerability Type: Excessive access to credential-bearing configuration
Risk Level: Medium

Vulnerable Code:

markdown
1. **Detect current platform** from the runtime (e.g. Cursor → `cursor`; Claude Code → `claude-code`; OpenClaw → `openclaw`). If unclear, **ask the user**; do not guess.
2. **Read only one setup file**: `references/setup-{platform}.md` (see table below). **Do not** read all `setup-*.md` files.
3. **MCP UI operations** — do **not** rely on hardcoded shortcuts or menu paths in this Skill. Instead:
   - Search **MCP** or **Model Context Protocol** in the current agent's Command Palette / Settings
   - Or read that platform's **official docs** / built-in help (e.g. cursor-guide in Cursor; OpenClaw Control UI `/settings/mcp`)
   - Optionally read the user's local MCP config (e.g. `~/.cursor/mcp.json`, `~/.openclaw/openclaw.json`) to verify setup
4. **VMEG-specific content** (endpoint, OAuth/API Key, config examples, presigned upload): read the current platform's setup file + [setup-common.md](references/setup-common.md) + [oauth.md](references/oauth.md).

The Cursor-specific setup document further states:

markdown
Agent may read `~/.cursor/mcp.json` to verify user config.

Technical Analysis

User-level MCP configuration files may contain authorization headers, bearer API keys, environment variables, server commands, and credentials for VMEG or unrelated MCP integrations. Reading the entire configuration file is broader than necessary to determine whether the VMEG server is configured.

The instructions do not require explicit user consent immediately before access, restrict inspection to the vmeg entry, prohibit reading unrelated entries, or require secret values to be redacted before entering model context. This violates least-privilege principles, particularly because c ...[truncated 1525 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove general permission to read complete user-level MCP configuration files.
  2. Prefer checking connection status and tool availability through the platform's MCP interface.
  3. If file inspection is necessary, obtain explicit user approval and explain that the file may contain credentials.
  4. Ask the user to provide a redacted copy of only the vmeg configuration entry.
  5. If automated parsing is supported, extract only non-secret fields from the named vmeg entry, such as server type and URL.
  6. Never place authorization headers, API keys, tokens, environment variables, or unrelated server entries into model context.
  7. Redact secret values at the tool boundary before results are returned to the agent.
  8. Recommend OAuth where supported and secure secret storage or environment-variable references instead of plaintext bearer keys in configuration files.
  9. Add an explicit prohibition against sending configuration content or credentials to the MCP server.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (27)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The install command invokes npx skills without pinning an exact package version, so users may execute whatever version is current in the registry at install time. If the upstream package is compromised, typosquatted, or updated with malicious code, the command can run attacker-controlled code on the user's system during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This command uses npx skills without an explicit version, creating a supply-chain risk because npx resolves and executes the latest available package. A malicious or compromised release could be executed immediately on the user's machine with the user's privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The example runs npx skills without version pinning, which means the executed installer behavior can change over time and can be hijacked through package compromise. Because this is installation guidance, users are especially likely to copy-paste it directly, increasing exposure to supply-chain attacks.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Using unpinned npx skills allows execution of a mutable remote package at runtime, which introduces a supply-chain execution risk. In a skill-install context, this is more dangerous because the documentation explicitly instructs users to run the command to add code into their agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This install example relies on npx to fetch and run an unpinned package version, which can expose users to malicious updates or registry compromise. Since the command installs a skill into an AI agent ecosystem, compromise could also affect agent behavior or local configuration.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

An unpinned npx skills command executes whatever package version is current, creating a classic supply-chain vulnerability window. Because users commonly trust official install docs, a compromised package could gain code execution through simple copy-paste installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The installation instruction points users to npx skills add without a fixed version, so the actual code executed is not stable or reviewable from the documentation alone. This creates a realistic supply-chain risk if the package or publisher account is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

npx -y @lobehub/market-cli runs an unpinned CLI package directly from the registry, which exposes users to malicious package updates or compromise of the package distribution channel. The -y flag also reduces friction and increases the likelihood of blind execution without review.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

This example executes @lobehub/market-cli via npx without version pinning, creating a supply-chain risk through mutable package resolution. Because it is framed as a marketplace install command, users may assume it is inherently trusted and execute it without further validation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The command fetches and runs an unpinned npm package, so a compromised or malicious future release could execute arbitrary code during installation. In this skill context, that risk is amplified because the command installs software into an agent tooling environment that may have access to sensitive local files or tokens.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

Running npx -y @lobehub/market-cli without a pinned version allows arbitrary changes in the executed code over time, which is a supply-chain vulnerability. Since this is installation documentation, exploitation would require little more than a user following the published instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The documentation instructs users to run npx skills add Pixripple/vmeg-skills --skill vmeg-media-translation ... without pinning an exact package version or immutable source reference. This can cause users to fetch whatever package version is current at execution time, increasing supply-chain risk if a malicious or compromised release is published; in a skill that configures MCP connectivity and may handle credentials, that risk is more significant than in a purely local utility.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The installation command uses npx skills without pinning an exact package version, so the resolved package can change over time or be influenced by dependency compromise. In a Codex/agent environment, this increases supply-chain risk because users are instructed to execute a remote package directly during setup, potentially leading to execution of unexpected code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The guide explicitly states that the agent may read ~/.cursor/mcp.json to verify user configuration, but gives no warning that this file may contain sensitive local configuration data, API keys, OAuth-related settings, or server endpoints. In the context of an agent skill, normalizing reads of local config files can expose secrets to the model or downstream tools and expands the blast radius of prompt- or tool-driven exfiltration.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The documentation instructs users to run npx skills add Pixripple/vmeg-skills ... without pinning an exact package version or immutable source reference. This creates a supply-chain risk: if the resolved package or referenced skill content changes, users may install unexpectedly modified code or configuration, which is especially sensitive here because the skill later configures an MCP integration that can access external services and credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The setup guide instructs users to place a bearer API key directly into a plaintext JSON config file without any warning about secret handling, file permissions, or safer alternatives. In the context of an agent skill that connects a remote MCP server, this increases the chance of credential leakage through source control, local compromise, backups, logs, or workspace sharing, which could allow unauthorized access to the user's VMEG account or project data.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The installation command invokes npx skills add without pinning a specific package version or immutable source revision. That allows upstream package changes, dependency compromise, or a malicious republish to alter what gets executed at install time, which is meaningful here because the skill installs into an agent environment and can influence MCP/tool behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The documentation instructs users to run npx skills add Pixripple/vmeg-skills --skill vmeg-media-translation -g -y without pinning a specific package or repository version. This creates a supply-chain risk: users may fetch whatever the latest published code resolves to at install time, so a compromised publisher account, dependency, or upstream change could silently deliver malicious code.

Content

No source excerpt is available for this finding.