ClawHub
Back to skill

Security audit

YouTube 视频深度解析

Security checks for vulnerabilities and agentic risk

Overview

The video-analysis workflow fits its purpose, but setup repeatedly asks you to paste a secret API key into chat despite assurances about local handling.

Require setup to avoid requesting secrets in chat. Configure CUE_API_KEY locally through a secure mechanism, and revoke or rotate any key already shared in a conversation. Cue receives submitted video links and may consume paid credits; consider whether those links are appropriate to share with the service.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

The setup script directs the agent to solicit the user's complete API key in chat under the pretext of configuring it locally.

High
Category
Data Exfiltration
Confidence
99% confidence
Finding

The mandatory onboarding message solicits the user's full secret under the assurance that it will be written only to local configuration, even though sending it through chat already discloses it outside that configuration. An exposed key could allow unauthorized API consumption and depletion of paid credits; this is the same underlying issue as the SDI-4 finding, not a separate compromise.

Content

No source excerpt is available for this finding.

The setup workflow requires users to disclose their API key in chat despite explicitly stating that the agent has no authority to view it.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

The setup instructions explicitly require the user to paste a complete API key into chat, contradicting the stated restriction that the agent must not view it. This unnecessarily exposes a billing-enabled credential to conversation storage and processing; prohibiting subsequent echoing does not undo the initial disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
CUE_KEY=$(python3 -c "import json,os;p=os.path.expanduser('~/.cue/config.json');print(json.load(open(p)).get('api_key','') if os.path.exists(p) else '')" 2>/dev/null || true)
CUE_KEY=${CUE_KEY:-$CUE_API_KEY}
echo "=== 1/3 API Key ===" && { [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！"; }
echo "=== 2/3 远程端点 ===" && curl -sS --max-time 10 -X POST "https://mcp.cuecue.cn/api/omni-reader/mcp/" \
  -H "Authorization: Bearer $CUE_KEY" \
  -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

解析调用手册

curl 三步

bash
# ① 提交解析（记下返回的 operation_id）

Static analysis

No suspicious patterns detected.