ClawHub
Back to skill

Security audit

video-content-pipeline

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent video-generation helper, but it includes an optional paid API-key scene generator that is not declared in the manifest permissions.

Review before installing. The free pipeline sends prompts to Pollinations and narration to Microsoft Edge TTS as disclosed. Do not use the paid scene_gen.py feature unless you intentionally set X402_API_KEY, understand the endpoint configured by X402_BASE, and accept possible charges and topic/API-key sharing. On shared machines, avoid running the compositor in a sensitive environment until its /tmp file handling is hardened.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The top-level description discloses only Pollinations and Microsoft Edge TTS, but the documentation later introduces an additional paid scene-generation API that sends user topic data externally and may charge the user's key. This mismatch can cause users or orchestration systems to trust the skill under incomplete assumptions about data egress, billing exposure, and required permissions.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The documented scope claims a full pipeline, but also includes an extra paid external capability outside the declared manifest scope. This undermines informed consent and can lead to accidental external data sharing or unexpected behavior by agents that rely on the manifest as the source of truth.

Scope Creep

High
Confidence
97% confidence
Finding
The paid scene-generation workflow implies outbound network access to an additional service that is not listed in the manifest permissions. Undeclared network destinations are dangerous because they bypass policy review, can exfiltrate user prompts or secrets, and may trigger unapproved financial transactions.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
This file introduces a paid external x402 scene-generation API that is not described in the stated skill purpose, which only mentions Pollinations image generation, Edge TTS, and composition. That mismatch is dangerous because users may unknowingly trigger billable external calls and send content to a third party outside the declared pipeline.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The code handles a spending-capable API key and performs paid transactions, yet this financial capability is not justified by the skill’s declared purpose. In an agent-skill context, unexpected monetized actions materially increase risk because a user or orchestrator may execute the script without understanding it can incur charges or expose a billable credential to an external service.

Missing User Warnings

Low
Confidence
82% confidence
Finding
The code writes to a fixed path (/tmp/concat.txt) without creating a unique temporary file securely. On multi-user systems, an attacker could pre-create this path as a symlink or race its creation, potentially causing overwrites of unintended files or manipulating the concat input used by ffmpeg.

Unvalidated Output Injection

High
Category
Output Handling
Content
if not (os.path.exists(img) and os.path.exists(aud)):
            print(f"⚠️ missing scene {sc['id']}"); continue
        part = f"/tmp/scene_{sc['id']:02d}.mp4"
        subprocess.run([
            "ffmpeg", "-y", "-loop", "1", "-i", img, "-i", aud,
            "-c:v", "libx264", "-tune", "stillimage", "-c:a", "aac",
            "-shortest", "-pix_fmt", "yuv420p", part
Confidence
90% confidence
Finding
The script writes intermediate output to predictable filenames in /tmp based on scene IDs, e.g. /tmp/scene_XX.mp4, without securely creating them. An attacker on the same host could exploit symlink or race conditions to overwrite arbitrary files accessible to the process, or poison the intermediate artifacts that are later concatenated.

Unvalidated Output Injection

High
Category
Output Handling
Content
# Escape enkelt-anførselstegn i filstier (ffmpeg concat-injektion fix 20/8)
    lines = ["file '" + p.replace("'", "'\\''") + "'\n" for p in parts]
    open(concat_file, "w").write("".join(lines))
    subprocess.run(["ffmpeg", "-y", "-f", "concat", "-safe", "0", "-i", concat_file,
                    "-c", "copy", out], capture_output=True)
    print(f"✅ Video: {out}")
Confidence
91% confidence
Finding
The final ffmpeg invocation accepts an unvalidated output path (out) directly from argv and also processes a concat file with -safe 0, reducing ffmpeg’s path restrictions. While this is not shell injection, it can enable arbitrary file overwrite in locations writable by the process and makes concat handling more dangerous if temporary-file manipulation occurs.

Static analysis

No suspicious patterns detected.