ClawHub
Back to skill

Security audit

music-video

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed music-video workflow that uses external media APIs, local ffmpeg, and approval gates; users should mainly verify install commands and understand that media is uploaded to generation services.

Before installing, verify the `npx skills add` source/version if your environment is sensitive. Use dedicated API keys with limited scope, avoid uploading confidential audio/images unless that is intended, and keep the documented approval gates before spending credits on generation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (22)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description says to use the skill when someone wants 'a full music video,' which is a broad natural-language condition without clear boundaries on what counts as a match or when another video-related skill should be used instead. Because this is a markdown/manifest context and the trigger lacks explicit exclusion conditions in the description itself, it could overlap with common creative requests and cause unintended invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill instructs operators to run npx skills add ... commands without pinning the installer/package manager itself to a specific trusted version. If the resolved skills package or execution path changes upstream or is hijacked, users may execute unexpected code during install in a high-trust setup flow.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This line repeats the same unsafe installation pattern: invoking npx skills without version-locking the executed tool. Because npx may fetch and run code dynamically, compromise of the package source or dependency resolution can lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The command on this line relies on npx skills without pinning the executable version, creating a supply-chain risk. In an agent-skill context, users are likely to copy-paste these commands directly, increasing the chance of silent execution of malicious or altered code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This unpinned npx skills invocation exposes users to remote code execution via package substitution, dependency compromise, or namespace confusion. Documentation-driven execution is especially risky because it normalizes running network-fetched code from the terminal.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The installation command uses an unpinned dynamic runner, which can pull whatever package version is current at execution time. That makes the skill susceptible to supply-chain compromise and nondeterministic behavior, both of which are security concerns for operational tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This line presents another copy-pasteable npx skills command without pinning the executable. Attackers exploiting package publication, typo-squatting, or dependency hijacking could execute arbitrary code during the install process.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill references npx skills dynamically here as well, inheriting the same supply-chain and arbitrary-code-execution risk. Because the skill is intended for media generation workflows, users may run these commands in environments that also hold API keys, magnifying impact.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

An unpinned npx skills bootstrap command appears again on this line. If the package ecosystem entrypoint is compromised, installation may lead to execution of attacker-controlled scripts with the user's privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The 'install the full suite' command also uses npx skills without pinning the tool version, expanding the blast radius because it installs a broader package set. This increases exposure to supply-chain attacks and makes behavior depend on mutable upstream state.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

json
{
  "prompt": "Slow dolly through neon city street at dusk, rain reflections, cinematic",
  "image": "https://api.pruna.ai/v1/files/STILL_ID",
  "audio": "https://api.pruna.ai/v1/files/SLICE_ID",
  "resolution": "720p",
  "fps": 24,

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

json
{
  "prompt": "Slow dolly through neon city street at dusk, rain reflections, cinematic",
  "image": "https://api.pruna.ai/v1/files/STILL_ID",
  "audio": "https://api.pruna.ai/v1/files/SLICE_ID",
  "resolution": "720p",
  "fps": 24,

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This related-skills install example again relies on unpinned npx skills, carrying the same remote-code and supply-chain risk. Repetition across the document increases the likelihood that users will execute one of these commands without scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This line repeats the unsafe dynamic execution pattern for installation. In security terms, any command that fetches and runs code from an external registry without pinning should be treated as a supply-chain hazard.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The command here exposes users to the same unpinned package execution risk. Since these are presented as standard setup steps, the context makes exploitation more plausible through social engineering and trusted-document abuse.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This install instruction continues the pattern of running an unpinned external tool through npx. A compromised upstream package or dependency could execute arbitrary postinstall or runtime scripts during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The final related-skills command also lacks pinning for the dynamic runner, preserving the same supply-chain weakness. The cumulative effect across the skill increases operational risk rather than being an isolated documentation issue.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The installation command invokes npx skills add ... without pinning an exact package version, so future executions may resolve to a different package release than the one originally reviewed. If the upstream package or dependency chain is compromised, users following the documentation could fetch and run attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This alternate install command also uses npx skills add ... without an exact pinned version, creating a supply-chain risk where later package updates or account compromise could change what code is executed. Because this appears in a quick-start style skill document, users are likely to copy-paste it directly, increasing practical exploitability.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium
Category
Output Handling
Confidence
60% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · lyrics-and-cuts.md (reported line 3)May include surrounding context.

md
# Lyrics and cut-safe editing

How to write lyrics for [Music 2.5](https://replicate.com/minimax/music-2.5) and map them to video clips **without cutting mid-word**. Workflow skill: `music-video`.

## Pipeline (lyrics → align)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · lyrics-and-cuts.md (reported line 119)May include surrounding context.

md
- **`voice_script`** on performance beats when you have the real song — use **`audio`** slice so lip sync matches the track.
- One grey-wall performance clip for every line — rotate settings per `generation-diversity`.
- New **`p-image`** identity per performance line when continuity was intended — use hero + **`p-image-edit`** instead.
- Cutting on beat without checking **syllable endings** — proportional timing can drift; always listen once.
- Lyrics that don't match section tags — model may blur section boundaries and break your cut map.

## Related

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The template sets voice_language to English (US), which is a natural-language locale constraint embedded in the skill content. There is no accompanying indication that the user can choose another language or that this locale is required for a documented region-specific purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.