ClawHub
Back to skill

Security audit

Google Free Media Skill

Security checks for vulnerabilities and agentic risk

Overview

This appears to be an incomplete demo skill that encourages Google browser session reuse and can misleadingly report media generation success, so it should be reviewed before installation.

Install only if you are comfortable treating this as a demo scaffold, not a working media generator. Use a dedicated Google account if you implement the browser automation, avoid storing reusable Google session data unless it is protected and isolated, pin dependencies with a lockfile, and fix the shell command construction before running it from untrusted paths.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:7
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_image.mjs:94
Finding

Shell Command Injection Through Unquoted Project Path

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
1. **Quota ฟรีจำกัด**: Gemini ~100 รูป/วัน, Flow ~50 credits/วัน (อาจเปลี่ยนแปลง)
2. **ช้ากว่า API**: ต้องเปิด browser และรอ UI load (5-10x ช้ากว่า)
3. **เสี่ยง UI เปลี่ยน**: Google เปลี่ยนปุ่ม/ตำแหน่งบ่อย → อาจต้อง update skill
4. **Terms of Service**: Automation อาจขัดกับ ToS ของ Google free tier

## 📋 ขั้นตอนการทำงาน

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Natural-language guidance throughout the file is presented only in Thai, including setup, troubleshooting, and usage instructions. Under the language/locale policy, forcing a specific language without user opt-in or documented justification is a policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly recommends persisting login cookies/session storage for reuse in browser automation, but does not mention secure storage, scope restriction, expiration, or the privacy/credential risks if those artifacts are stolen. In this context, session tokens may grant direct access to the user's Google account and associated services without requiring a password, making compromise of the automation host materially dangerous.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module header and manifest context present this skill as an operational free AI image generator using browser automation. However, the actual generateWithGemini function is explicitly a skeleton/demo and only saves placeholder metadata to a .json file while printing demo instructions, so the behavior materially differs from the claimed functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file description and operational messages are written in Thai, and the CLI help/output throughout the script is primarily Thai-facing. This imposes a specific language on users without any opt-in or alternative locale selection, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The success message implies completion of image generation and points to the requested output image path. In reality, the code writes only outputPath.replace('.jpg', '.json'), so users are told an image was produced when it was not, which is a direct description-behavior mismatch.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file description and subsequent CLI messages are written in Thai, and the script does not provide any option to select another language or indicate that it is intentionally limited to Thai-speaking users. This creates a language/locale policy issue because the skill imposes a specific language by default without user opt-in.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/generate_image.mjs (reported line 81)May include surrounding context.

js
console.error('❌ ไม่พบ Chrome/Chromium ในระบบ');
    console.error('');
    console.error('ติดตั้งด้วยคำสั่ง:');
    console.error('  Ubuntu/Debian: sudo apt install chromium-browser');
    console.error('  macOS: brew install --cask google-chrome');
    return false;
  }

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/generate_video.mjs (reported line 52)May include surrounding context.

js
console.error('❌ ไม่พบ Chrome/Chromium ในระบบ');
    console.error('');
    console.error('ติดตั้งด้วยคำสั่ง:');
    console.error('  Ubuntu/Debian: sudo apt install chromium-browser');
    console.error('  macOS: brew install --cask google-chrome');
    return false;
  }

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script advertises video generation and accepts an .mp4 output path, but in demo mode it only writes a JSON placeholder and never creates the promised video file. This can mislead downstream automation into treating the job as successful, causing integrity and workflow failures such as publishing missing assets or skipping error handling.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The completion message states success and prints the requested output path even though no video was generated there in demo mode. In an agent skill context, this is especially risky because other tools or users may rely on status text rather than artifact verification, leading to false success, broken pipelines, or accidental use of nonexistent media.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code hard-codes the Thai locale and Bangkok timezone for date handling and uses Thai-only user-facing output throughout the script. This creates a natural-language/locale policy issue because the skill does not offer any user opt-in or configuration for language/locale selection, and no region-specific justification is provided in the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file provides commands that generate image files to a specified output path, and later also shows analogous video generation commands. The guide gives no user-facing warning that running these commands will create files on disk and may overwrite existing files depending on script behavior, which is a data-affecting action relevant to markdown warning requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description forces a specific language for user-facing instructions, and the rest of the document is likewise Thai-centric. There is no opt-in, alternative language, or stated reason that the skill must be limited to Thai users.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The inline comment at L054 states that Thai input will be converted to English first. The actual logic only detects Thai text and logs that it will be used as-is because Gemini supports Thai, which directly contradicts the comment.

Content

No source excerpt is available for this finding.