Comic Drama Generate

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:20 AM UTC
• Version: 1.0.1

Overview

The skill’s creative video workflow is coherent, but its setup tells users to run unpinned remote installs and includes a credential fallback that can expose an API key.

Review the setup before installing. Prefer pinned, reviewed versions of the installer and prerequisite skills instead of `@latest`, run installation with minimal permissions, and avoid the documented `--api-key` fallback unless you understand the process-argument exposure risk. Use only non-sensitive public asset URLs and a dedicated project directory for generated files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:22

Finding

Mutable Dependencies Are Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:22-26; duplicated in references/install-checklist.md:8-14 and PUBLISHING.md:33-39
Vulnerability Type: Unsafe execution of unpinned third-party dependencies
Risk Level: High

bash

npx clawhub@latest install video-prompt-generator
npx clawhub@latest install nano-banana-pro
npx clawhub@latest install sora-2-generate

Technical Analysis

The documented installation process invokes clawhub@latest through npx and installs three prerequisite Skills without pinned versions or integrity constraints. Both the package providing the installer and the installed components are therefore mutable.

Because npx can download and execute package code, the effective code running on the host may differ from the code available when this Skill was audited. No checksum, lockfile, exact version, trusted revision, or independent verification requirement is specified. This creates a supply-chain trust boundary through which a compromised package release, publisher account, registry, or prerequisite Skill can introduce arbitrary executable behavior.

The audit did not establish that the current dependencies are malicious. The vulnerability is the unsafe mutable dependency and execution model.

Attack Path

1. An attacker compromises the clawhub package, its publisher account, a registry distribution channel, or one of the named prerequisite Skills.
2. The attacker publishes a malicious release under the mutable version selected by @latest or replaces a prerequisite Skill revision.
3. A user or Agent follows the documented installation commands.
4. npx downloads and runs the mutable installer package.
5. Malicious package lifecycle logic, installer behavior, or installed Skill code executes with the permissions of the invoking user or Agent.
6. The payload can access resources available to that account, including project files, environment variables, configured ...[truncated 493 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace clawhub@latest with an exact, reviewed version.
2. Pin each prerequisite Skill to an immutable version or commit digest.
3. Verify package integrity with trusted checksums, signatures, or lockfile integrity metadata before execution.
4. Independently audit prerequisite Skills and their transitive dependencies.
5. Use a trusted internal registry or allowlist where feasible.
6. Disable package lifecycle scripts unless they are explicitly required and reviewed.
7. Run installation in a sandbox with minimal filesystem access, restricted environment variables, and constrained network permissions.
8. Document a controlled dependency-update process requiring review before changing pinned versions.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/install-checklist.md:51

Finding

API Key Can Be Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: references/install-checklist.md:51-58; the fallback is also directed by SKILL.md:39-40 and PUBLISHING.md:23-26
Vulnerability Type: Sensitive credential disclosure through process arguments
Risk Level: Medium

bash

python3 skills/nano-banana-pro/scripts/nano_banana_generate.py \
  --api-key "$NANOPHOTO_API_KEY" \
  --prompt "..." \
  --mode generate \
  --aspect-ratio 9:16 \
  --image-quality 2K

Technical Analysis

The fallback command expands NANOPHOTO_API_KEY into the child process's argument vector. Environment-variable expansion does not preserve secrecy after the value is inserted into --api-key; the resulting process command line contains the plaintext credential.

Depending on operating-system policy and deployment configuration, command-line arguments may be observable through process inspection interfaces, monitoring agents, audit systems, telemetry, job logs, crash reports, or orchestration metadata. This creates avoidable exposure beyond the target process.

The project correctly recommends environment-based execution as the preferred path and warns users not to paste keys into chat. However, retaining the command-line fallback still introduces a credential disclosure path.

Attack Path

1. Normal environment inheritance is unavailable or fails.
2. A user or Agent follows the documented --api-key fallback.
3. The shell expands $NANOPHOTO_API_KEY before starting the Python process.
4. The plaintext key becomes part of the process argument vector.
5. A local user, process-monitoring service, audit collector, telemetry system, or log capture mechanism records or reads the command line.
6. An attacker with access to that data extracts the key and uses it against the associated API.

Impact Assessment

Exposure of NANOPHOTO_API_KEY could permit unauthorized use of NanoPhoto-backed prerequisite services, consumption of paid ...[truncated 309 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --api-key fallback from documentation and supported execution paths.
2. Pass credentials only through protected environment injection, a platform secret manager, or another non-argv secret channel supported by the prerequisite tool.
3. If environment inheritance is unreliable, update the helper script to accept the secret through standard input or a permission-restricted secret descriptor.
4. Ensure logs, telemetry, crash reports, and process-monitoring systems redact credentials.
5. Apply least privilege to the API key and restrict its service scope, quota, and lifetime where supported.
6. Rotate the credential immediately if command lines containing it may already have been collected.
7. Prevent secrets from being written to shell history, project documentation, generated asset manifests, or debugging output.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/asset-rules.md (reported line 50)May include surrounding context.

md

- use the keyframe URL as the shot anchor
- default to 15-second single-shot clips unless production constraints require another supported duration
- keep the prompt focused on motion, mood, and camera evolution
- do not rewrite character identity in ways that contradict the keyframe

## If results drift

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The documentation instructs users to execute npx clawhub@latest install ..., which fetches and runs the latest package version at execution time rather than a pinned, reviewed version. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users may execute untrusted code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Using npx clawhub@latest install nano-banana-pro relies on an unpinned package version and causes code to be downloaded and executed dynamically. In a skill that orchestrates other tools and may handle API-backed workflows, this increases exposure to supply-chain compromise if the package or its dependencies are tampered with.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The install example executes npx clawhub@latest, which is a classic unpinned remote execution pattern in package ecosystems. An attacker who compromises the package, publisher account, or dependency chain could gain code execution on the user's machine during setup.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The description lists expansive triggers such as 'when the user wants to turn an idea into scripts, storyboards, 15-second single-shot videos, and final edited episodes' and multiple loosely bounded creative intents. This lacks clear exclusion conditions or a narrow invocation scope, increasing the chance the skill is invoked for general storytelling or video-creation requests beyond this specific pipeline.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx clawhub@latest install ..., which fetches and executes the latest published package rather than a pinned, reviewed version. This creates a supply-chain risk: if the package or a dependency is compromised, arbitrary code could run on the user's machine during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This line repeats the same unpinned npx clawhub@latest execution pattern, which can run newly published code without review. In a skill that explicitly asks the operator to install prerequisites, that materially increases the chance of supply-chain compromise affecting the local environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Like the other install commands, this invokes an unpinned remote package via npx, exposing the user to arbitrary code execution if the package, maintainer account, or dependency tree is compromised. Because the command is presented as required setup, users may run it with little scrutiny.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill directs local downloading, saving, trimming, merging, and exporting of files, but it does not require an explicit warning or confirmation before modifying the filesystem. In an agentic environment, this can lead to unexpected local writes, large disk usage, or overwriting project data, especially because the workflow is framed as deterministic and mandatory.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/asset-rules.md (reported line 59)May include surrounding context.

md

2. keyframe quality
3. video prompt motion language

Do not skip directly to regenerating many videos without checking the upstream asset chain.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The install command uses npx clawhub@latest, which fetches and executes the most recent package version rather than a reviewed, fixed version. If the upstream package is compromised or a breaking/malicious release is published, users of this checklist could execute untrusted code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This command also relies on npx clawhub@latest, making the installation of nano-banana-pro dependent on whatever package version is current at execution time. That creates a supply-chain risk because npx will run code from the resolved package, and a compromised or hostile release could affect anyone following the instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Using npx clawhub@latest here exposes installers to the same unpinned remote-code-execution risk for the sora-2-generate dependency path. Because this is an installation checklist meant to be copied and run, the unsafe pattern is especially likely to propagate into real operator workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.