ClawHub
Back to skill

Security audit

短剧生成器

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent cloud TTS drama generator, but it needs Review because its own instructions can expose the SenseAudio API key in terminal output or command-line history.

Install only if you are comfortable sending generated dialogue to SenseAudio. Do not let the agent print your API key, do not pass it with --senseaudio-api-key, and prefer a protected environment variable or secret manager. Avoid using sensitive or proprietary story content unless you accept both the cloud TTS processing and the local saved JSON copy.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:18
Finding

API Key Disclosed in Terminal Output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_drama.py:198
Finding

API Key Accepted Through Command-Line Arguments

Content
View full analysis
" ``` ### Technical Analysis Command-line arguments are not an appropriate channel for secrets. Depending on the operating system and runtime environment, arguments may be observable through process inspection interfaces, monitoring agents, audit records, command execution logs, or shell history. The script already supports `SENSEAUDIO_API_KEY`, so accepting the same credential through an argument is unnecessary for its declared functionality and expands the credential's exposure surface. The HTTPS request itself is consistent with the declared cloud TTS functionality: the key is sent as a Bearer credential to `https://api.senseaudio.cn/v1/t2a_v2`, along with dialogue text and voice settings. The security issue is the local delivery mechanism, not the necessary authenticated TTS request. ### Attack Path 1. A user follows the documented example and enters the SenseAudio key after `--senseaudio-api-key`. 2. The shell records the command in history, or the running command is captured by process monitoring or execution logs. 3. A local user, administrator, monitoring service, or log reader obtains the command-line value. 4. The observer extracts ...[truncated 457 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
USAGE.md:8
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation
``` For stronger integrity guarantees: - Generate a lock file containing transitive dependency versions. - Record and enforce cryptographic hashes, such as with `pip install --require-hashes -r requirements.txt`. - Use an explicitly trusted package index. - Install dependencies inside a dedicated virtual environment. - Periodically review and update pinned versions for security fixes. - Avoid instructing users to install dependencies with elevated operating-system privileges. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language description and example invocation are entirely in Chinese, and the file does not indicate that other languages are supported or that Chinese is a required, justified locale constraint. This can violate language/locale policy when a specific language is implicitly mandated without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README describes automatic script generation and TTS synthesis but does not clearly warn users that their provided theme, generated dialogue, and character text will be transmitted to an external SenseAudio API. This creates a real transparency and privacy issue because users may unknowingly send sensitive or proprietary content to a third-party service with different retention or logging practices.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill instructs the agent to read an environment variable, write a temporary JSON file, invoke a Python script, and call an external TTS API, but it does not declare any tool scope or permission boundaries. That mismatch increases the chance of overbroad execution and secret exposure because the runtime may allow capabilities that are not explicitly constrained or auditable.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad, natural-language requests like '帮我生成一个短剧' and '做一个有声剧', with no confirmation step or tighter scope constraints. Broad triggers can cause accidental invocation in unrelated conversations, leading the agent to generate files, access secrets, or make networked API calls when the user did not clearly intend to run this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide explicitly recommends passing the SenseAudio API key on the command line, which can expose the secret through shell history, process listings, terminal logging, or CI/job telemetry. Even though this is documentation rather than executable code, it encourages an insecure operational practice that can lead to credential theft and unauthorized API usage.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_drama.py (reported line 22)May include surrounding context.

python
# ============== API 配置 ==============
SENSEAUDIO_API_KEY = os.environ.get("SENSEAUDIO_API_KEY", "")
SENSEAUDIO_API_URL = "https://api.senseaudio.cn/v1/t2a_v2"

# 可用音色列表（voice_id → 描述）
VOICE_CATALOG = {

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This code performs intentional external transmission of user-provided dialogue text and an API credential to a remote service. Although necessary for cloud TTS functionality, it still represents a genuine data exposure boundary and is more sensitive because the skill processes arbitrary user-authored content.

Content

Scanner excerpt · scripts/generate_drama.py (reported line 56)May include surrounding context.

python
}
    for retry in range(3):
        try:
            resp = requests.post(SENSEAUDIO_API_URL, json=payload, headers=headers, timeout=60)
            result = resp.json()
            if result.get("data") and result["data"].get("audio"):
                return bytes.fromhex(result["data"]["audio"])

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script sends the full dialogue text to a third-party TTS service, which may include sensitive or proprietary user content, but it does not clearly warn the user at the point of use. In a skill context, users may assume processing is local, so silent external transmission creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Tainted flow: 'output_path' from input (line 226, user input) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/generate_drama.py (reported line 177)May include surrounding context.

python
final_wav = concat_wavs(wav_list, gap_sec=gap_sec)

    os.makedirs(os.path.dirname(os.path.abspath(output_path)) or ".", exist_ok=True)
    with open(output_path, 'wb') as f:
        f.write(final_wav)

    # 保存剧本 JSON

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

Natural-language policy violations include forcing a specific language without user opt-in. This skill presents its description, usage instructions, and examples only in Chinese, and it does not state that the skill is region-specific or offer an alternative language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The file title, instructions, examples, and expected prompts are all presented in Chinese, including the example invocation text at L024-L032. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script persists both the generated audio and a full copy of the script JSON to disk without an explicit warning, which can unintentionally store sensitive content locally. This is a privacy issue rather than code execution, but it can expose user data to other local users, backups, or later accidental disclosure.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/generate_drama.py:200