ClawHub
Back to skill

Security audit

ugc-ads

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Ofox video-generation guide that uses an API key and paid generation commands with an explicit quote-and-approval gate.

Install only if you are comfortable using an Ofox API key and sending prompts, optional product images, and approved paid generation requests to Ofox. Review any npx recovery command before running it, keep the API key in the environment rather than prompts, and require a dry-run cost table before any --approved command.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Anti-Refusal Statement

High
Category
Anti-Refusal
Content
the frame and pass **no** `--aspect-ratio`, while this file treats 9:16 as
  the default nobody is asked about. With a frame attached the model forces
  `adaptive` and the clip takes the **photo's** shape, so an ordinary
  landscape product shot silently cancels the vertical premise — no error, no
  warning, and it is discovered on delivery. The crop is free and local, it is
  what the measured run did (529x941 in, 480x854 out), and it now appears in
  the table, in a note under it, and as a line in the recap. Found by reading
Confidence
80% confidence
Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium
Category
Rogue Agent
Content
→ "If the attached frame's background disagrees with your SCENE". **It hurts
this scenario more than any other**, because an unbroken, un-staged single take
is the entire product and the cut lands on frame one. Fixes, cheapest first:
write the `SCENE` as the place the photo was actually taken; or use a photo
already shot in the target setting; or trim the first 0.15s before delivery.

**⚠️ Anti-polish was weaker, and two variables changed at once.** Run 1's
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
The template says the spoken line should be written 'in the language to be spoken,' which makes the agent determine output language from prompt construction rather than explicit user choice. This can violate language/locale policy if the user was not asked or offered a choice for dialogue language.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The file states, 'Write the line in the language it should be spoken in — that is what decides the voice's language.' This directs the agent to set the clip's language itself, with no explicit requirement to confirm the user's preferred language first.

Missing User Warnings

Low
Confidence
77% confidence
Finding
The markdown repeatedly instructs users to provide an OFOX_API_KEY and notes that the same key works across every Ofox skill, but this file does not include a clear warning to avoid exposing, sharing, or logging that credential. Because credential use is central here and the file is the user-facing skill description, a brief warning about secret handling would improve user disclosure.

Static analysis

No suspicious patterns detected.