ClawHub
Back to skill

Security audit

Picasso TikTok

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent TikTok/Reels video pipeline, but it routes generated voice audio through an unrelated public file host and includes opinionated promotional script defaults that users should review carefully.

Install only if you are comfortable sending scripts, audio, prompts, and generated media to the listed AI providers, and do not use it for confidential voiceovers unless the uguu.se upload is replaced with private, expiring storage or an official HeyGen upload path. Also review the generated script for unwanted CTA or brand language before approving audio generation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:61
Finding
Mandatory Promotional CTA Alters User-Requested Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 61-71 **Vulnerability Type**: Output instruction hijacking through mandatory promotional content **Risk Level**: Medium ### Vulnerable Code ```markdown **Reglas:** - Español argentino rioplatense (voseo: "grabás", "actualizás", "imaginá") - Hook fuerte en los primeros 3 segundos - Dinámico, sin relleno - Sin notas de dirección, solo el texto que se lee - CTA al final (ej: "sumate a Morfeo Labs") - Duración objetivo: igual o levemente mayor que el video fuente **Mostrar guión y esperar aprobación antes de generar audio.** ``` ### Technical Analysis The Skill makes inclusion of a call to action a default script requirement and provides the specific promotional phrase `"sumate a Morfeo Labs"` as its example. A promotional CTA is not technically necessary to generate, subtitle, or compose a TikTok/Reels video. Because these rules are presented as mandatory workflow instructions, an agent loading the Skill may incorporate promotional or branded material even when the user only requested neutral video generation. Although the later approval step provides some opportunity for review, it does not remove the initial manipulation of the proposed output or guarantee that the user understands the branding originated from the Skill. This behavior exceeds the minimum instructions necessary for the declared video-production functionality and compromises the user's editorial control. ### Attack Path 1. A user invokes the Skill to create a video without requesting advertising or branded content. 2. The agent loads the mandatory script rules from `SKILL.md`. 3. The agent writes a script containing a CTA and may use the supplied Morfeo Labs promotion. 4. The promotional text is converted to speech and incorporated into the generated video if it is not noticed or removed during review. 5. The user may publish content that advertises an unrelated entity. ### Impact Assessment The issue does not grant ...[truncated 416 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Remove the CTA from the mandatory script rules. - Default to no CTA unless the user explicitly requests one. - Ask the user to provide or approve the exact organization, destination, and wording before adding promotional language. - Do not include a third-party brand as a default example in executable workflow instructions. - Clearly label any proposed CTA as optional when presenting the script for approval. - Add a final validation step that confirms the finished video contains no unrequested advertising, endorsements, links, or brand references. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:148
Finding
Generated Voice Audio Is Uploaded to an Unrelated Public File Host<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 148-155 **Vulnerability Type**: Unauthorized third-party disclosure of potentially sensitive audio **Risk Level**: High ### Vulnerable Code ```markdown ### Subir audio a uguu.se (requerido por HeyGen) ```python import requests with open("audio.mp3", "rb") as f: r = requests.post("https://uguu.se/upload", files={"files[]": ("audio.mp3", f.read(), "audio/mpeg")}, timeout=30) audio_url = r.json()["files"][0]["url"] ``` ``` ### Technical Analysis The workflow uploads the complete generated voiceover to `https://uguu.se/upload`, an external file-sharing service, and then passes the resulting URL to HeyGen. The audio may contain unpublished scripts, personal statements, client material, internal business information, or voice content intended only for the requested production. The Skill describes this external upload as required but does not: - Obtain informed user consent. - Warn the user that the audio will be sent to an additional service. - Authenticate or restrict access to the returned URL. - Establish a short expiration period. - Delete the uploaded file after HeyGen retrieves it. - Validate the upload service's retention, logging, or redistribution policies. - Provide an approved, user-controlled storage alternative. The upload is functionally useful because HeyGen expects an audio URL, but using an unrelated file-sharing host is not the least-privileged implementation. A private object store with a short-lived signed URL or an authenticated upload facility would expose the content to fewer parties and for a shorter period. ### Attack Path 1. A user supplies a confidential or unpublished script. 2. The Skill sends the script to ElevenLabs and stores the generated result in `audio.mp3`. 3. The workflow reads the entire audio file into memory. 4. It uploads the complete file to `uguu.se`. 5. The service returns a remotely accessible URL. 6. That URL is sent to HeyGen as ...[truncated 1022 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Prefer an official authenticated HeyGen audio-upload endpoint if one is available. - Otherwise, store the audio in user-controlled private storage and provide HeyGen with a single-use, short-lived signed URL. - Require explicit informed consent before sending audio to any additional processor. - Disclose each service receiving the audio, its purpose, and applicable retention behavior. - Configure the shortest practical URL expiration and deny public listing or anonymous reuse. - Delete the remote object immediately after HeyGen confirms retrieval or the generation job ends. - Avoid predictable filenames and prevent search-engine indexing. - Validate TLS certificates and check HTTP status codes and response schemas before using the returned URL. - Add failure handling so unexpected upload responses are not treated as trusted URLs. - Do not upload content marked confidential unless the user has explicitly approved the selected storage provider. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:40
Finding
Unpinned Package Installation Creates a Mutable Supply-Chain Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 40-45 **Vulnerability Type**: Unpinned runtime dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ### Google Drive ```bash pip install gdown -q gdown "https://drive.google.com/uc?id=FILE_ID&confirm=t" -O output.mp4 ``` ``` ### Technical Analysis The Skill instructs the agent to install `gdown` from the configured Python package index at runtime without specifying a version or verifying a cryptographic hash. The reviewed Skill therefore does not determine which package artifact will actually be installed during a future run. A compromised upstream release, package-index account, mirror, or dependency could cause code selected after this audit to execute with the privileges of the agent environment. The quiet installation option also reduces useful visibility into installation warnings and dependency changes. This is a supply-chain weakness rather than evidence that the current `gdown` project is malicious. The risk arises from trusting a mutable package resolution process during task execution. ### Attack Path 1. The agent follows the Google Drive download instructions. 2. `pip` queries its configured package index for the latest compatible `gdown` release. 3. The package index or dependency resolution process supplies a compromised or otherwise unsafe artifact. 4. Installation invokes package build or installation behavior and places the package in the active Python environment. 5. The agent executes the installed `gdown` command. 6. Malicious package code runs with the same filesystem, environment-variable, and network access available to the agent. ### Impact Assessment A successfully compromised dependency could execute arbitrary code with the privileges of the account running the Skill. Depending on the host environment, that could permit: - Reading project and media files accessible to the agent. - Reading environment variables, potentially includi ...[truncated 511 chars]
Remediation
<![CDATA[ ## Remediation Suggestions - Pin `gdown` to a reviewed exact version. - Verify the package and all transitive dependencies using cryptographic hashes. - Record dependencies in a locked requirements file, for example using hash-enforced installation. - Install dependencies during a controlled build or provisioning phase rather than during normal Skill execution. - Use a dedicated virtual environment or container with minimal filesystem and credential access. - Avoid quiet installation so warnings and resolved versions remain visible in logs. - Configure `pip` to use an approved package index over TLS. - Periodically review pinned versions for security updates and update them through a documented review process. - Where practical, replace runtime package installation with a preinstalled, reviewed downloader or a narrowly scoped native HTTP implementation. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (18)

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill instructs uploading generated audio to uguu.se, a public third-party file host, solely to obtain a URL for HeyGen. This exposes potentially sensitive voice/script content to an unrelated service without any user-facing disclosure, retention guarantees, access controls, or consent step, creating a real confidentiality and data-governance risk.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The script rules require 'Español argentino rioplatense (voseo)' as a fixed output style. This imposes a specific locale and language variant without indicating that the user can choose another language or dialect, which conflicts with the language/locale policy criteria.

External Transmission

Medium
Category
Data Exfiltration
Content
import requests, time

CACHE = "/home/ubuntu/clawd/projects/picasso-tiktok/cache/JOB_NAME"
BASE_URL = "https://api.elevenlabs.io/v1/text-to-speech/$ELEVENLABS_VOICE_ID"
HEADERS = {"xi-api-key": "$ELEVENLABS_API_KEY", "Content-Type": "application/json"}

# Variación A — expresivo, pausas fuertes
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
]

for ver, text, settings in configs:
    r = requests.post(BASE_URL, headers=HEADERS,
        json={"text": text, "model_id": "eleven_multilingual_v2", "voice_settings": settings})
    with open(f"{CACHE}/audio_{ver}.mp3", "wb") as f:
        f.write(r.content)
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Backup: Cartesia sonic-3
```python
r = requests.post("https://api.cartesia.ai/tts/bytes",
    headers={"X-API-Key": "$CARTESIA_API_KEY",
             "Cartesia-Version": "2025-04-16", "Content-Type": "application/json"},
    json={"model_id": "sonic-3",  # SIEMPRE sonic-3, nunca sonic-2
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Backup: Cartesia sonic-3
```python
r = requests.post("https://api.cartesia.ai/tts/bytes",
    headers={"X-API-Key": "$CARTESIA_API_KEY",
             "Cartesia-Version": "2025-04-16", "Content-Type": "application/json"},
    json={"model_id": "sonic-3",  # SIEMPRE sonic-3, nunca sonic-2
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Backup: Cartesia sonic-3
```python
r = requests.post("https://api.cartesia.ai/tts/bytes",
    headers={"X-API-Key": "$CARTESIA_API_KEY",
             "Cartesia-Version": "2025-04-16", "Content-Type": "application/json"},
    json={"model_id": "sonic-3",  # SIEMPRE sonic-3, nunca sonic-2
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Backup: Cartesia sonic-3
```python
r = requests.post("https://api.cartesia.ai/tts/bytes",
    headers={"X-API-Key": "$CARTESIA_API_KEY",
             "Cartesia-Version": "2025-04-16", "Content-Type": "application/json"},
    json={"model_id": "sonic-3",  # SIEMPRE sonic-3, nunca sonic-2
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Backup: Cartesia sonic-3
```python
r = requests.post("https://api.cartesia.ai/tts/bytes",
    headers={"X-API-Key": "$CARTESIA_API_KEY",
             "Cartesia-Version": "2025-04-16", "Content-Type": "application/json"},
    json={"model_id": "sonic-3",  # SIEMPRE sonic-3, nunca sonic-2
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
### Backup: Cartesia sonic-3
```python
r = requests.post("https://api.cartesia.ai/tts/bytes",
    headers={"X-API-Key": "$CARTESIA_API_KEY",
             "Cartesia-Version": "2025-04-16", "Content-Type": "application/json"},
    json={"model_id": "sonic-3",  # SIEMPRE sonic-3, nunca sonic-2
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import requests

with open("audio.mp3", "rb") as f:
    r = requests.post("https://uguu.se/upload",
        files={"files[]": ("audio.mp3", f.read(), "audio/mpeg")}, timeout=30)
audio_url = r.json()["files"][0]["url"]
```
Confidence
99% confidence
Finding
This upload sends audio.mp3 to uguu.se, a public third-party file host, before passing the resulting URL to HeyGen. Unlike the other API calls, this introduces unnecessary exposure to an uncontrolled intermediary and may make the file publicly accessible or retrievable by others.

External Transmission

Medium
Category
Data Exfiltration
Content
HEYGEN_KEY = "$HEYGEN_API_KEY"
AVATAR_ID  = "aa7ca06de7454b9caa147b97a534e813"  # Paul default

r = requests.post("https://api.heygen.com/v2/video/generate",
    headers={"X-Api-Key": HEYGEN_KEY, "Content-Type": "application/json"},
    json={
        "video_inputs": [{
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
HEYGEN_KEY = "$HEYGEN_API_KEY"
AVATAR_ID  = "aa7ca06de7454b9caa147b97a534e813"  # Paul default

r = requests.post("https://api.heygen.com/v2/video/generate",
    headers={"X-Api-Key": HEYGEN_KEY, "Content-Type": "application/json"},
    json={
        "video_inputs": [{
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
HEYGEN_KEY = "$HEYGEN_API_KEY"
AVATAR_ID  = "aa7ca06de7454b9caa147b97a534e813"  # Paul default

r = requests.post("https://api.heygen.com/v2/video/generate",
    headers={"X-Api-Key": HEYGEN_KEY, "Content-Type": "application/json"},
    json={
        "video_inputs": [{
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import requests, os

with open("audio.mp3", "rb") as f:
    r = requests.post("https://api.openai.com/v1/audio/transcriptions",
        headers={"Authorization": f"Bearer {os.environ['OPENAI_API_KEY']}"},
        files={"file": ("audio.mp3", f, "audio/mpeg")},
        data={"model": "whisper-1", "response_format": "verbose_json",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```python
import requests, os, time

r = requests.post("https://api.replicate.com/v1/models/runwayml/gen-4.5/predictions",
    headers={"Authorization": f"Token {os.environ['REPLICATE_API_TOKEN']}", "Content-Type": "application/json"},
    json={"input": {
        "prompt": "DESCRIPCION_CINEMATOGRAFICA",
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```python
import requests, os, time

r = requests.post("https://api.replicate.com/v1/models/runwayml/gen-4.5/predictions",
    headers={"Authorization": f"Token {os.environ['REPLICATE_API_TOKEN']}", "Content-Type": "application/json"},
    json={"input": {
        "prompt": "DESCRIPCION_CINEMATOGRAFICA",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```python
import requests, os, time

r = requests.post("https://api.replicate.com/v1/models/runwayml/gen-4.5/predictions",
    headers={"Authorization": f"Token {os.environ['REPLICATE_API_TOKEN']}", "Content-Type": "application/json"},
    json={"input": {
        "prompt": "DESCRIPCION_CINEMATOGRAFICA",
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.