ClawHub
Back to skill

Security audit

UGC Manual

Security checks for vulnerabilities and agentic risk

Overview

The skill largely does what it claims, but it handles sensitive face and voice media with third-party upload, unclear consent boundaries, and unsafe URL/temp-file handling that should be reviewed before installation.

Install only if you are comfortable sending face images, voice recordings, audio URLs, and generated media through ComfyDeploy. Use only media you own or have consent to process, provide a least-privileged ComfyDeploy API key, avoid private/internal URLs, and prefer running it in a constrained environment until upload consent, URL limits, timeouts, temp-file cleanup, and dependency locking are improved.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate.py:204
Finding

Unbounded Downloads from User-Controlled and API-Controlled URLs

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate.py:231
Finding

Sensitive Temporary Audio File Is Not Reliably Deleted

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
scripts/pyproject.toml:7
Finding

Runtime Dependency Is Not Reproducibly Pinned

Content
View full analysis
=2.28.0", ] ``` ### Technical Analysis The project accepts any future `requests` release satisfying the lower-bound constraint. No reviewed lockfile is present in the audited project structure. This does not establish that the current `requests` package is malicious or vulnerable. However, runtime dependency resolution is not reproducible and can select package versions that were not reviewed with the Skill. The risk is particularly relevant when `uv run` resolves and installs dependencies in an automated environment. ### Attack Path 1. The Skill is executed in an environment without an existing locked dependency installation. 2. The package resolver retrieves the newest release satisfying `requests>=2.28.0`. 3. A future compromised, defective, or unexpectedly incompatible release is selected without a source-code change in this project. 4. The installed package is imported by `generate.py`. 5. Any malicious package initialization code would execute with the same filesystem, environment, and network permissions as the Skill process. This is a supply-chain risk scenario rather than evidence that the currently named dependency is malicious. ### Impact Assessment If dependency resolution were compromised, code could execute with the privileges of the user or service account running the Skill. That could expose the `COMFY_DEPLOY_API_KEY`, user media available to the process, writable files, and network access. The likelihood is limited because the dependency uses the legitimate `requests` package name from the normal package ecosystem; no typosquatting or unsafe custom index was identified. ]]>
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (17)

Tainted flow: 'headers' from os.environ.get (line 111, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate.py (reported line 113)May include surrounding context.

python
files = {"file": (os.path.basename(file_path), f, content_type)}
        headers = {"Authorization": f"Bearer {api_key}"}
        
        response = requests.post(
            f"{COMFY_DEPLOY_API_URL}/file/upload",
            headers=headers,
            files=files

Tainted flow: 'headers' from os.environ.get (line 111, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate.py (reported line 145)May include surrounding context.

python
}
    }
    
    response = requests.post(
        f"{COMFY_DEPLOY_API_URL}/run/deployment/queue",
        headers=headers,
        json=payload

Tainted flow: 'headers' from os.environ.get (line 111, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate.py (reported line 169)May include surrounding context.

python
if time.time() - start_time > timeout:
            raise TimeoutError(f"Run did not complete within {timeout} seconds")
        
        response = requests.get(
            f"{COMFY_DEPLOY_API_URL}/run/{run_id}",
            headers=headers
        )

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/generate.py (reported line 26)May include surrounding context.

python
def get_api_key():
    """Get API key from environment."""
    api_key = os.environ.get("COMFY_DEPLOY_API_KEY")
    if not api_key:
        raise ValueError(

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises and documents capabilities that require shell execution, network access, and likely environment access, but it does not declare any tool scope or permissions boundaries. This creates a mismatch between what the agent may do and what reviewers or users can assess, increasing the risk of unintended command execution or data handling without explicit approval.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill says it should not be used when AI voice generation is needed, but later lists externally generated TTS as a normal use case. This contradiction can misroute requests and bypass intended control separation between skills, making it easier to use synthetic voices in a workflow represented as manual user audio.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The documented workflow sends user media to an external service at api.comfydeploy.com, which is a genuine external transmission path. External transmission is not inherently malicious, but in this context it is security-relevant because the uploaded content includes face images and voice audio that can be sensitive and potentially identifying.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
## API Details

**Endpoint:** `https://api.comfydeploy.com/api/run/deployment/queue`
**Deployment ID:** `075ce7d3-81a6-4e3e-ab0e-7a25edf601b5`

## Required Inputs

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill accepts image and audio inputs and specifies an external API endpoint, but it does not warn that those user-provided files will be transmitted to a third party. Because image and voice recordings are highly sensitive biometric and personal data, failing to disclose external transfer can violate user expectations, consent requirements, and privacy controls.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest frames the skill as operating on a user's own recording, but the later documentation broadens it to arbitrary audio sources, including externally generated or non-user content. That inconsistency weakens safety expectations and can cause the skill to be applied to third-party audio or content types the user did not intend, undermining consent and policy boundaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill accepts arbitrary remote image and audio URLs, downloads remote audio locally, and uploads media to a third-party cloud service, but the skill description frames the tool as operating on user-provided files. This mismatch can cause unanticipated data egress and creates SSRF-style risk against internal or sensitive URLs if the execution environment can reach them.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The hardcoded external API endpoint establishes a built-in data egress path to a third-party service. While not inherently malicious, this is security-significant because the skill handles user image/audio content and the manifest does not clearly communicate off-platform transfer.

Content

Scanner excerpt · scripts/generate.py (reported line 21)May include surrounding context.

python
import requests

# ComfyDeploy API configuration
COMFY_DEPLOY_API_URL = "https://api.comfydeploy.com/api"
DEPLOYMENT_ID = "075ce7d3-81a6-4e3e-ab0e-7a25edf601b5"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The script depends on a third-party cloud API and reads a bearer credential from the environment, but that external dependency and credential use are not disclosed in the skill description. In a skill context, undisclosed secret usage and off-platform processing are security-relevant because operators may unknowingly grant networked data access and expose user media to an external processor.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate.py (reported line 76)May include surrounding context.

python
]
    
    try:
        result = subprocess.run(
            cmd,
            capture_output=True,
            text=True,

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/generate.py (reported line 89)May include surrounding context.

python
raise RuntimeError(f"Failed to convert audio: {e.stderr}")
    except FileNotFoundError:
        raise RuntimeError(
            "FFmpeg not found. Install with: sudo apt install ffmpeg"
        )

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This request queues processing on an external cloud service using user-provided media URLs, meaning user content and associated metadata leave the local environment. In the context of a skill that appears simple and local from its description, undisclosed external transmission materially increases privacy and compliance risk.

Content

Scanner excerpt · scripts/generate.py (reported line 145)May include surrounding context.

python
}
    }
    
    response = requests.post(
        f"{COMFY_DEPLOY_API_URL}/run/deployment/queue",
        headers=headers,
        json=payload

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The manifest presents the skill as a straightforward media transformation, but the implementation shells out to ffmpeg for audio conversion. Local subprocess execution is an additional capability that is not described and is not inherent from the manifest wording alone.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.