ClawHub
Back to skill

Security audit

mediaproc

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed SSH client for a trusted media-processing container, with the main risk being that files and commands go to whichever mediaproc host the user configures.

Install only if you control or trust the mediaproc host. Keep MEDIAPROC_HOST and MEDIAPROC_PORT under your control, review any optional root installer before running it, and get explicit confirmation before using remote delete operations.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
This is a mismatch because the description presents a constrained media-processing capability, but the implementation simply SSHes to a remote host and executes whatever command string is supplied. Even if the intended environment is a locked-down media container, that restriction is not implemented or verified by this code. The code therefore exposes broader remote execution behavior than the description states.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The manifest frames this skill as processing media files with ffmpeg, sox, and imagemagick in a constrained container. However, the script accepts any <command> and passes it verbatim over SSH, with no validation or restriction to media-processing tools, so the implemented behavior is broader than the stated media-only purpose.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
Executing arbitrary commands on a remote host is a broad capability that goes beyond the manifest's stated role of transcoding and manipulating media files. While SSH transport may be an implementation detail, unrestricted command dispatch is not obviously required for the described purpose.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script initiates a remote SSH command and enables `StrictHostKeyChecking=accept-new`, which changes trust state by automatically accepting previously unseen host keys. There is no prompt, warning, or user-facing disclosure in the script comments or runtime output that this network action will occur and that trust-on-first-use behavior is enabled.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.