ClawHub
Back to skill

Security audit

MCBAI Douyin Dubber

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real video-dubbing utility, but users should review it because it needs a full Douyin session cookie and its “fully local” wording understates external AI/TTS data sharing.

Install only if you are comfortable using a throwaway Douyin account cookie, rotating it after use, and having transcript/translated text sent to the AI agent and whichever TTS provider you choose. Run it in a dedicated environment, avoid private videos, and treat the Edge TTS header patching and unpinned dependencies as review points rather than hidden malware.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
)

    tts_track = workdir / "tts_track.mp3"
    subprocess.run(
        [FFMPEG, "-y"] + inputs + [
            "-filter_complex", ";".join(filter_parts),
            "-map", "[aout]",
Confidence
83% confidence
Finding
The ffmpeg filter_complex string is assembled from subtitle-derived timestamps and paths, then handed to ffmpeg's parser without robust escaping. While not shell injection, complex ffmpeg filter expressions are their own interpreted language, so malformed or hostile values can cause parse failures, unintended graph behavior, or denial of service in a pipeline that processes untrusted media/transcript content.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
ass_path_fwd = str(ass_path).replace("\\", "/").replace(":", "\\:")
    sub_filter = f"subtitles='{ass_path_fwd}':fontsdir='C\\:/Windows/Fonts'"

    subprocess.run([
        FFMPEG, "-y",
        "-i", str(video), "-i", str(tts_track),
        "-filter_complex",
Confidence
91% confidence
Finding
The code constructs an ffmpeg subtitles filter string using a filesystem path derived from user-controlled output location and feeds it into filter_complex. ffmpeg filter arguments have their own escaping rules, and incomplete escaping can let crafted paths break parsing or alter filter behavior; in addition, processing untrusted subtitle/media content through ffmpeg increases exposure to parser-level bugs and denial of service.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# Delay tăng dần: lần 1 = 2-4s, retry = 5-10s để tránh rate limit
        delay = 2.0 + random.uniform(1.0, 2.0) if attempt == 0 else 5.0 + random.uniform(2.0, 5.0)
        _time.sleep(delay)
        r = subprocess.run([_sys.executable, "-c", script],
                           capture_output=True, text=True,
                           env={**os.environ, "PYTHONUTF8": "1"})
        if r.returncode == 0 and out_path.exists() and out_path.stat().st_size > 100:
Confidence
98% confidence
Finding
This code builds a Python program as a string containing untrusted subtitle text and voice values, then executes it with python -c. Because repr(text_clean) and repr(voice) are embedded into generated code, specially crafted input can break out of the string literal context or otherwise alter executed code, creating a direct interpreter-injection path.

Tainted flow: 'req' from pathlib.Path.read_text (line 602, file read) → urllib.request.urlopen (network output)

High
Category
Data Flow
Content
req.add_header("xi-api-key", api_key)
    req.add_header("Content-Type", "application/json")
    req.add_header("Accept", "audio/mpeg")
    with urllib.request.urlopen(req, timeout=30) as resp:
        out_path.write_bytes(resp.read())
Confidence
94% confidence
Finding
Subtitle text is sent to ElevenLabs over the network, contradicting the 'fully local' skill description and transmitting potentially sensitive content to a third party. In a dubbing pipeline, transcript text can contain personal data or copyrighted material, so silent exfiltration to a remote service is a meaningful privacy and trust risk.

Tainted flow: 'script' from pathlib.Path.read_text (line 614, file read) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
# Delay tăng dần: lần 1 = 2-4s, retry = 5-10s để tránh rate limit
        delay = 2.0 + random.uniform(1.0, 2.0) if attempt == 0 else 5.0 + random.uniform(2.0, 5.0)
        _time.sleep(delay)
        r = subprocess.run([_sys.executable, "-c", script],
                           capture_output=True, text=True,
                           env={**os.environ, "PYTHONUTF8": "1"})
        if r.returncode == 0 and out_path.exists() and out_path.stat().st_size > 100:
Confidence
99% confidence
Finding
This is a true interpreter-injection issue: data that originates from subtitle content is embedded into dynamically generated Python source and executed with python -c. Any attacker who can influence subtitle text could potentially achieve arbitrary code execution in the local environment running the skill.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill description promises a fully local pipeline, but the implementation uses remote translation handoff semantics plus cloud TTS providers such as gTTS and ElevenLabs. This is a security-relevant trust violation because users may provide private media believing no data leaves the machine.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The Edge TTS implementation deliberately patches headers to impersonate a browser and Chrome extension, which is evasive behavior and may bypass normal service controls or mislead upstream providers. That increases legal, operational, and trust risk, especially in a skill presented as a normal dubbing utility.

Static analysis

No suspicious patterns detected.