ClawHub
Back to skill

Security audit

mediaproc

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed SSH-based media-processing wrapper for a configured container, with the main caution that the configured host can see transferred files and remote delete commands are permanent.

Install only if you control or trust the configured mediaproc host. Review the pinned installer before running it with sudo, protect MEDIAPROC_HOST and MEDIAPROC_PORT from untrusted changes, and require explicit confirmation before using remove-file, remove-dir, or remove-dir-recursive because deletion is permanent in the remote work directory.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/mediaproc.sh:13
Finding

Destructive remote file operations lack an enforced confirmation gate

Content
View full analysis

Vulnerability Details

File Location: scripts/mediaproc.sh:13-16; related confirmation requirement at SKILL.md:142-145
Vulnerability Type: Missing authorization enforcement for destructive operations
Risk Level: Medium

Vulnerable code:

bash
exec ssh -p "$MEDIAPROC_PORT" \
    -o StrictHostKeyChecking=accept-new \
    -o LogLevel=ERROR \
    "mediaproc@$MEDIAPROC_HOST" "$*"

Documented security requirement:

markdown
**Destructive.** `remove-file`, `remove-dir`, and `remove-dir-recursive`
permanently delete data in the remote work directory — there is no trash/undo.
`remove-dir-recursive` deletes an entire subtree in one call and is especially
dangerous. Only run these after explicit user confirmation of the exact path.

Technical Analysis

The wrapper forwards the entire command supplied by the calling agent to the configured SSH service without distinguishing destructive commands from ordinary media-processing or read-only operations. In particular, it does not require a confirmation option, confirmation token, interactive prompt, or dry-run before forwarding remove-file, remove-dir, or remove-dir-recursive.

Although SKILL.md instructs the agent to obtain explicit confirmation for the exact path, this requirement is only documentary. The executable entrypoint does not enforce it and can be invoked directly by an agent or another integration without evidence that the user approved the deletion.

The dangerous operation crosses the authorization boundary between an agent-generated command and the user’s authenticated remote media workspace. The SSH key grants the wrapper authority to delete data, while the caller is trusted to enforce confirmation entirely outside the script.

Attack Path

  1. The Skill runs with MEDIAPROC_HOST and MEDIAPROC_PORT configured and has access to the user’s SSH identity.
  2. A calling agent or integration constructs a destructive ...[truncated 1244 chars]
Remediation
View remediation

Remediation Suggestions

  • Parse the requested operation before opening the SSH connection and explicitly identify destructive commands.
  • Require a dedicated confirmation argument or short-lived confirmation token for remove-file, remove-dir, and remove-dir-recursive.
  • Bind confirmation to the exact command and normalized target path so approval for one location cannot authorize another.
  • Reject destructive commands when confirmation is absent, rather than relying solely on agent instructions.
  • Prefer a separate entrypoint for destructive operations to reduce accidental invocation.
  • Add a dry-run or target-listing mode, especially for recursive deletion.
  • Preserve the server-side work-directory confinement and command allowlist as defense-in-depth controls.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 26)May include surrounding context.

bash
# Add your SSH key
cat ~/.ssh/id_rsa.pub >> ~/.mediaproc/authorized_keys

# Basic start (detached)
mediaproc start -d

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/setup.md (reported line 17)May include surrounding context.

bash
# Pick a released tag: https://github.com/psyb0t/docker-mediaproc/releases
REF=vX.Y.Z
curl -fsSL "https://raw.githubusercontent.com/psyb0t/docker-mediaproc/${REF}/install.sh" -o install.sh
less install.sh            # review exactly what runs as root
sudo bash install.sh

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 19)May include surrounding context.

REF=vX.Y.Z curl -fsSL "https://raw.githubusercontent.com/psyb0t/docker-mediaproc/${REF}/install.sh" -o install.sh less install.sh # review exactly what runs as root sudo bash install.sh

text

## Starting

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest frames this skill as processing media files with tools inside a locked-down container, but this script also depends on host and port values supplied through environment variables and initiates a remote SSH session. While remote execution may support the implementation, consuming connection configuration from the environment is an additional capability not described as part of the skill's purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script transparently executes user-supplied commands on a remote system over SSH without any explicit notice, consent boundary, or confirmation at runtime. In an agent setting, this can cause users or higher-level components to believe processing is local when commands and possibly piped data are actually sent to another host, creating confidentiality, compliance, and trust risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.