ClawHub
Back to skill

Security audit

Cinematic Kling

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its video-generation purpose, but it should be reviewed because it sources a local .env file as executable shell and uploads user images/prompts to ComfyDeploy/S3.

Review before installing. Only use this skill with images and prompts you are comfortable sending to ComfyDeploy/S3, and provide the API key through a managed secret or existing environment variable rather than sourcing a general `.env` file. Avoid placing unrelated secrets in `~/clawd/.env` if following the documented commands.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:92
Finding

Overbroad and Executable Environment File Loading

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 92
Vulnerability Type: Unsafe shell evaluation of a credential configuration file
Risk Level: Medium

Vulnerable Code:

bash
source ~/clawd/.env

Technical Analysis

The Skill requires only COMFY_DEPLOY_API_KEY, but the documented command uses the shell source built-in to evaluate the entire ~/clawd/.env file as executable shell code. An .env file is therefore not treated merely as configuration: command substitutions, shell functions, redirections, and arbitrary commands in that file execute with the invoking user's privileges.

This behavior exceeds the minimum privilege required for the declared functionality. The API key should either already be provided through the process environment or be read from a narrowly scoped configuration source without evaluating it. Sourcing the complete file also imports unrelated variables and secrets into the Skill's process environment.

Attack Path

  1. An attacker, compromised process, or untrusted installer obtains write access to ~/clawd/.env.
  2. The attacker inserts shell commands or command substitutions into the file.
  3. A user follows the Skill's upload procedure.
  4. The shell executes source ~/clawd/.env.
  5. The injected commands run before the legitimate ComfyDeploy requests and inherit the permissions and accessible environment of the Agent user.

Exploitation requires the attacker to gain write access to the referenced environment file or influence its contents. The Skill does not itself grant that access, but it turns a configuration-file compromise into a command-execution path.

Impact Assessment

Successful exploitation permits arbitrary command execution under the account invoking the Skill. The attacker could read or alter files accessible to that account, access environment variables and credentials, make network requests, or tamper with generated outputs. The issue do ...[truncated 404 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove source ~/clawd/.env from the documented workflow.
  • Prefer requiring COMFY_DEPLOY_API_KEY to be supplied through the process environment or a dedicated secret manager.
  • If file-based configuration is unavoidable, use a parser that treats the file strictly as data and retrieves only the exact COMFY_DEPLOY_API_KEY field. Do not use source, eval, or command substitution.
  • Store the credential in a dedicated file with restrictive permissions, such as mode 0600, rather than a shared environment file containing unrelated secrets.
  • Validate that the key exists before issuing requests without printing its value:
    bash
    : "${COMFY_DEPLOY_API_KEY:?COMFY_DEPLOY_API_KEY is required}"
  • Avoid enabling shell tracing while handling the key, and do not include the authorization header in diagnostic output.
  • Document that user-provided images are uploaded to ComfyDeploy so users can make an informed decision before transmitting potentially personal media.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The skill instructs sourcing a local .env file to load API credentials into the shell environment. Encouraging direct credential loading in operational instructions increases the risk of accidental secret exposure through shell history, debugging, subprocess inheritance, or misuse by downstream steps in an agent environment.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

ALWAYS upload local files to ComfyDeploy's own storage first. NEVER use external/custom domains.

bash
source ~/clawd/.env

upload_to_comfy() {
  curl -s -X POST "https://api.comfydeploy.com/api/file/upload" \

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md
# Download outputs to allowed directory
mkdir -p ~/clawd/output/cinematic-kling
BASE_URL="https://comfy-deploy-output.s3.us-east-2.amazonaws.com/outputs/runs/$RUN_ID"
curl -sL "$BASE_URL/CS_2_00001_.png" -o ~/clawd/output/cinematic-kling/character-sheet.png
curl -sL "$BASE_URL/ITEM_00001_.png" -o ~/clawd/output/cinematic-kling/item-sheet.png
curl -sL "$BASE_URL/LOCATION_00001_.png" -o ~/clawd/output/cinematic-kling/location-sheet.png
curl -sL "$BASE_URL/ComfyUI_00001_.mp4" -o ~/clawd/output/cinematic-kling/video.mp4

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
## Deployment

- **Deployment ID:** `e5258667-dec2-438f-84d0-f22049692483`
- **API:** `POST https://api.comfydeploy.com/api/run/deployment/queue`
- **Auth:** `Authorization: Bearer $COMFY_DEPLOY_API_KEY`

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
## Deployment

- **Deployment ID:** `e5258667-dec2-438f-84d0-f22049692483`
- **API:** `POST https://api.comfydeploy.com/api/run/deployment/queue`
- **Auth:** `Authorization: Bearer $COMFY_DEPLOY_API_KEY`

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md
## Deployment

- **Deployment ID:** `e5258667-dec2-438f-84d0-f22049692483`
- **API:** `POST https://api.comfydeploy.com/api/run/deployment/queue`
- **Auth:** `Authorization: Bearer $COMFY_DEPLOY_API_KEY`

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

md
## Deployment

- **Deployment ID:** `e5258667-dec2-438f-84d0-f22049692483`
- **API:** `POST https://api.comfydeploy.com/api/run/deployment/queue`
- **Auth:** `Authorization: Bearer $COMFY_DEPLOY_API_KEY`

---

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The embedded image tool prompt is hard-coded in Spanish: Para cada imagen, decí brevemente.... This imposes a specific language choice on the interaction without offering the user a language option or documenting a justified locale constraint.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The upload step transmits local files directly to ComfyDeploy storage, creating an explicit external transfer of potentially sensitive user-provided images. Because the skill mandates uploading first and forbids alternative domains, the exposure is systematic rather than incidental.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md
source ~/clawd/.env

upload_to_comfy() {
  curl -s -X POST "https://api.comfydeploy.com/api/file/upload" \
    -H "Authorization: Bearer $COMFY_DEPLOY_API_KEY" \
    -F "file=@$1" | jq -r '.file_url'
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This duplicate finding refers to the same external POST request used to queue the run. The danger comes from mandatory third-party processing of user media and prompts, which may include proprietary or personal content.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

Step 2 — Submit Run

bash
RUN_ID=$(curl -s -X POST "https://api.comfydeploy.com/api/run/deployment/queue" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMFY_DEPLOY_API_KEY" \
  -d "{

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This duplicate finding refers to the same external POST request used to queue the run. The danger comes from mandatory third-party processing of user media and prompts, which may include proprietary or personal content.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

Step 2 — Submit Run

bash
RUN_ID=$(curl -s -X POST "https://api.comfydeploy.com/api/run/deployment/queue" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $COMFY_DEPLOY_API_KEY" \
  -d "{

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This duplicate finding points to the same Python POST request that transmits workflow inputs to ComfyDeploy. The core risk is third-party exposure of user images and prompts, not the mere presence of HTTP requests.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md
)
    
    # Submit job
    r = requests.post(
        "https://api.comfydeploy.com/api/run/deployment/queue",
        headers={"Content-Type": "application/json", "Authorization": f"Bearer {API_KEY}"},
        json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This duplicate finding points to the same Python POST request that transmits workflow inputs to ComfyDeploy. The core risk is third-party exposure of user images and prompts, not the mere presence of HTTP requests.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md
)
    
    # Submit job
    r = requests.post(
        "https://api.comfydeploy.com/api/run/deployment/queue",
        headers={"Content-Type": "application/json", "Authorization": f"Bearer {API_KEY}"},
        json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The Python helper explicitly posts user-controlled inputs to ComfyDeploy's API, again creating third-party data exposure. In context this is expected functionality, but it remains a real privacy/security concern when handling personal images or sensitive creative assets.

Content

Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.

md
# Submit job
    r = requests.post(
        "https://api.comfydeploy.com/api/run/deployment/queue",
        headers={"Content-Type": "application/json", "Authorization": f"Bearer {API_KEY}"},
        json={
            "deployment_id": "e5258667-dec2-438f-84d0-f22049692483",

Static analysis

No suspicious patterns detected.