ClawHub
Back to skill

Security audit

tiktok-carousel

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed TikTok carousel generator that can upload chosen image files to Postiz drafts, with configuration and dependency risks but no evidence of hidden or destructive behavior.

Install this in a virtual environment, pin or lock dependencies before production use, keep API keys in environment variables or a secrets manager, confirm POSTIZ_API_URL is the real Postiz API, and only upload generated or intentionally selected image files. Review the draft and caption before publishing.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Tainted flow: 'url' from os.getenv (line 42, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"caption": caption,
        "privacy_level": privacy_level,
    }
    resp = requests.post(url, headers=headers, json=payload)
    try:
        resp.raise_for_status()
    except Exception as e:
Confidence
93% confidence
Finding
The request target is derived from the environment variable POSTIZ_API_URL with no validation, so a compromised runtime environment can redirect authenticated API calls to an attacker-controlled host. Because the Authorization bearer token and draft content are sent in the request, this can leak credentials and content and enable SSRF-style outbound connections.

Tainted flow: 'url' from os.getenv (line 42, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
headers = _auth_headers()
    with p.open('rb') as fh:
        files = {'file': fh}
        resp = requests.post(url, headers=headers, files=files)
    try:
        resp.raise_for_status()
    except Exception as e:
Confidence
95% confidence
Finding
The upload endpoint is built from POSTIZ_API_URL and used to send local file contents plus the bearer token to whatever host the environment specifies. If an attacker can influence environment variables, they can exfiltrate arbitrary local files passed to this function and steal API credentials by redirecting uploads to an attacker-controlled server.

Unpinned Dependencies

Low
Category
Supply Chain
Content
openai>=1.0.0
requests>=2.28.0
Pillow>=10.0.0
python-dotenv>=1.0.0
Confidence
95% confidence
Finding
The dependency is specified with a lower bound only, which allows future major or minor versions to be installed without review. This increases supply-chain and stability risk because a later release could introduce a vulnerability or breaking change into the skill environment.

Unpinned Dependencies

Low
Category
Supply Chain
Content
openai>=1.0.0
requests>=2.28.0
Pillow>=10.0.0
python-dotenv>=1.0.0
Confidence
98% confidence
Finding
The requests package is unpinned, so installs may resolve to different versions over time, including vulnerable or behavior-changing releases. Because this library is commonly used for outbound HTTP and credential-bearing requests, uncontrolled upgrades can increase exposure to known and future dependency issues.

Unpinned Dependencies

Low
Category
Supply Chain
Content
openai>=1.0.0
requests>=2.28.0
Pillow>=10.0.0
python-dotenv>=1.0.0
Confidence
99% confidence
Finding
Pillow is unpinned, which permits installation of arbitrary newer versions without validation. Since image-parsing libraries frequently process untrusted binary data and have a history of memory corruption and resource-consumption flaws, leaving this dependency floating materially increases risk.

Unpinned Dependencies

Low
Category
Supply Chain
Content
openai>=1.0.0
requests>=2.28.0
Pillow>=10.0.0
python-dotenv>=1.0.0
Confidence
90% confidence
Finding
python-dotenv is not pinned, so dependency resolution can change across environments and over time. While lower impact than network or parser libraries, this still creates supply-chain uncertainty and could introduce security-relevant behavior changes in configuration handling.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
93% confidence
Finding
The requirements file permits installation of requests versions with multiple published advisories because no upper bound or exact safe version is enforced. In practice, this can expose the skill to issues such as credential leakage, TLS/verification problems, or other HTTP security flaws depending on the resolved version and how the library is used.

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical
Category
Supply Chain
Confidence
97% confidence
Finding
The requirements allow vulnerable Pillow releases, and Pillow has a history of severe issues including image parsing flaws, denial of service, and in some cases code execution. If the skill processes user-supplied or remote images, this context makes the dependency especially dangerous because crafted files may trigger exploitation during normal operation.

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
81% confidence
Finding
The dependency may resolve to a python-dotenv version affected by a file-overwrite issue involving symlink following in set_key. The practical risk depends on whether the skill actually invokes that function on attacker-influenced paths, but the lack of version pinning means a vulnerable build can be installed.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.