ClawHub
Back to skill

Security audit

Image To Video

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent as an image-to-video guide, but its install instructions ask users to run internet-downloaded code directly in a shell.

Review before installing. Prefer a manual, version-pinned CLI install with checksum or signature verification instead of running the pipe-to-shell command, and avoid the optional related-skill `npx` installs unless you can verify the exact versions you are adding.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:14
Finding

Unverified Remote Installer Executed Directly by Shell

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:232
Finding

Unpinned Third-Party Skill Installation Through npx

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

curl -fsSL https://cli.inference.sh | sh is a classic external script fetching anti-pattern: it executes remote content immediately, with no opportunity for inspection before execution. If the remote server, DNS, TLS termination, CDN, or release process is compromised, arbitrary code runs on the user's machine, making this a real and material supply-chain risk.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

Quick Start

bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Generate a still image
infsh app run falai/flux-dev-lora --input '{

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs users to execute a remote script directly via curl ... | sh, which gives network-fetched code immediate shell execution with the user's privileges. In a skill intended as a content-generation guide, this is more dangerous because users may copy-paste it as a trusted prerequisite, creating a straightforward supply-chain compromise path if the host, transport, or distribution pipeline is ever abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The command fetches and runs downloaded shell code without a prominent warning or mandatory verification step, encouraging unsafe copy-paste behavior. Even though the note below mentions checksum verification, it appears after the executable example and does not mitigate the initial risky pattern, so the context makes misuse more likely.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes a still-to-video conversion guide focused on model selection, motion prompting, and camera movement for animating images. However, the documented workflow expands beyond image-to-video into generating source images, upscaling videos, synthesizing ambient audio, and merging media, which materially broadens the skill's actual behavior and implied purpose.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The manifest presents the skill as a guide for still-to-video conversion techniques and model usage. The quick start additionally instructs users to download and install a remote CLI and log in, which is operational setup outside the core image-to-video guidance described in the manifest.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.