ClawHub
Back to skill

Security audit

Transcribe Media

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its media transcription purpose, but crafted public media links may be able to make requests from the user's machine to internal network targets.

Review before installing. Only use this with media links you trust, because a malicious public URL could potentially cause the downloader to contact internal services reachable from your machine. Also expect the skill to contact AudioFlow, store an AudioFlow API token locally, upload media only after explicit approval, and optionally cache yt-dlp after separate approval.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/remote-media.mjs:135
Finding

DNS Rebinding and Redirect-Based SSRF in Public Media Processing

Content
View full analysis
!isPublicAddress(address, family)) ) { throw new Error("The media host did not resolve to public addresses."); } if (signal?.aborted) { throw new Error("The transcription timed out or was interrupted."); } } ``` The original hostname is subsequently passed to `yt-dlp`, which performs its own DNS resolution and may follow redirects: ```js async function inspectVideo( executable, url, { signal, runYtDlpImpl, environment }, ) { const output = await runYtDlpImpl( executable, [ ...baseYtDlpArguments(), "--skip-download", "--dump-single-json", "--extractor-args", "youtube:skip=translated_subs", "--", url.href, ], { signal, maximumStdoutBytes: MAXIMUM_METADATA_BYTES, environment }, ); return parseMetadata(output); } ``` The one-time validation is performed before the downloader is invoked: ```js await assertPublicHostname(url, lookupImpl, signal); ``` The same unpinned URL is also passed to subtitle and media download operations at lines 517–530 and 567–578. ### Technical Analysis This is a time-of-check/time-of-use validation flaw. `assertPublicHostname` verifies that a Node.js DNS lookup returns only public addresses, ...[truncated 2582 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
Resolve the directory containing this `SKILL.md` as `{baseDir}` and check the

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/xiaoyuzhou.md (reported line 35)May include surrounding context.

md
## Handle the result

Treat the ASR result as an immutable raw transcript and follow the direct-output
rules in the main `SKILL.md`. After obtaining a result, do not download the audio
again or call AudioFlow again.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credentials.mjs (reported line 180)May include surrounding context.

js
if (!pathApi.isAbsolute(override)) {
      throw new Error("AUDIOFLOW_CONFIG_DIR must be an absolute path.");
    }
    return pathApi.join(override, "credentials.json");
  }
  if (platform === "win32") {
    const appData = environment.APPDATA?.trim();

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credentials.mjs (reported line 187)May include surrounding context.

js
if (!pathApi.isAbsolute(override)) {
      throw new Error("AUDIOFLOW_CONFIG_DIR must be an absolute path.");
    }
    return pathApi.join(override, "credentials.json");
  }
  if (platform === "win32") {
    const appData = environment.APPDATA?.trim();

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/credentials.mjs (reported line 194)May include surrounding context.

js
if (!pathApi.isAbsolute(override)) {
      throw new Error("AUDIOFLOW_CONFIG_DIR must be an absolute path.");
    }
    return pathApi.join(override, "credentials.json");
  }
  if (platform === "win32") {
    const appData = environment.APPDATA?.trim();

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · scripts/transcribe.mjs (reported line 439)May include surrounding context.

js
!Number.isSafeInteger(session.size_bytes) ||
    session.size_bytes <= 0
  ) {
    throw new Error("The upload session response is invalid.");
  }
  if (
    session.mode === "multipart" &&

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · scripts/transcribe.mjs (reported line 448)May include surrounding context.

js
!Number.isSafeInteger(session.size_bytes) ||
    session.size_bytes <= 0
  ) {
    throw new Error("The upload session response is invalid.");
  }
  if (
    session.mode === "multipart" &&

Context Leakage

High
Category
Data Exfiltration
Confidence
85% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · scripts/transcribe.mjs (reported line 749)May include surrounding context.

js
!Number.isSafeInteger(session.size_bytes) ||
    session.size_bytes <= 0
  ) {
    throw new Error("The upload session response is invalid.");
  }
  if (
    session.mode === "multipart" &&

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This code initiates a remote authorization flow by POSTing client and token metadata to audioflow123.com and persists pending credentials locally via savePendingCredentials, but the file contains no user-facing disclosure, confirmation prompt, or warning before doing so. Because this is a code file, network transmission and credential persistence are safety-relevant operations that should have some visible disclosure unless clearly surfaced elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The waitForAuthorization function repeatedly sends request_id and poll_secret to remote endpoints and then promotes stored credentials, but there is no print/log/confirmation explaining that the command will continue contacting the service and handle authentication material. For code files, transmission of authentication-related data should have some user disclosure when not otherwise clearly warned in the file.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest’s default prompt instructs use of the skill whenever a user wants to summarize media or ask questions using source content, but it does not define specific trigger phrases, scope limits, or exclusion conditions. This ambiguity could cause the skill to be invoked in ordinary summarization contexts beyond the intended media-transcription use case.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.