ClawHub
Back to skill

Security audit

tl_video_downloader

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real video downloader, but it needs review because a normal download request can run local commands and automatically install unpinned software on the host.

Install only if you are comfortable with this skill running local commands, downloading media into your Downloads folder, and potentially changing your Python or system package environment. Prefer a version that requires yt-dlp and ffmpeg to be installed ahead of time, passes URLs as structured arguments, validates URLs, and asks before making host changes.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:11
Finding

Command Injection Risk Through Unquoted URL Interpolation

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/main.py:49
Finding

Automatic Installation of Unpinned Third-Party Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared purpose is only video downloading, but the detected behavior includes installing dependencies, writing to local Downloads, and modifying the host via external commands. This mismatch is dangerous because users and platform policy may not expect host changes or package installation, creating a path for unauthorized environment modification and broader system impact.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Executing pip, apt, brew, or choco from a skill materially increases the blast radius from content processing to host modification. In this context, a downloader does not need package-manager authority at runtime, so this is an unjustified and risky capability that could be abused to install software, alter packages, or fail unpredictably under elevated privileges.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs use of an execution tool to run a local command, but it does not declare any explicit tool scope or permission boundary. This is dangerous because the agent may invoke shell-like capabilities without transparent authorization constraints, increasing the risk of unintended command execution or privilege misuse if the skill is triggered with untrusted input.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description does not warn that downloading and merging videos will write files to the local filesystem. This is dangerous because users may unknowingly trigger persistent local changes, consume storage, or overwrite expected locations without informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The operational instructions are written as mandatory Chinese-language behavior and do not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill tells the agent to execute a subprocess and return only its output, without warning the user that a local command will be run. This reduces transparency and can hide risky local execution from the user, especially when the command incorporates user-supplied URLs and may trigger additional behavior in the underlying script.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest describes a downloader, but the implementation also installs and upgrades host dependencies. This capability expansion is security-relevant because users and platform operators may grant trust based on a narrower purpose while the code can change system state and reach package repositories.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/main.py (reported line 17)May include surrounding context.

python
# 检查依赖是否存在
        if pkg_name == "ffmpeg":
            # ffmpeg 用 -version
            subprocess.run([pkg_name, "-version"], check=True, capture_output=True, text=True)
        else:
            # 其他工具（如 yt-dlp）用 --version
            subprocess.run([pkg_name, "--version"], check=True, capture_output=True, text=True)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/main.py (reported line 20)May include surrounding context.

python
subprocess.run([pkg_name, "-version"], check=True, capture_output=True, text=True)
        else:
            # 其他工具（如 yt-dlp）用 --version
            subprocess.run([pkg_name, "--version"], check=True, capture_output=True, text=True)
        print(f"✅ {pkg_name} 已安装")
        return True
    except (subprocess.CalledProcessError, FileNotFoundError):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script installs missing dependencies automatically after only printing status messages, with no interactive confirmation or explicit authorization boundary. That means a routine request to download a video can unexpectedly trigger software installation and system changes, increasing the chance of unauthorized modification or accidental execution in sensitive environments.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

This code automatically executes package-manager installation commands on the host when dependencies are missing. That grants the skill the ability to modify the local system, install or upgrade software, and invoke privileged package managers without explicit user approval, which is dangerous well beyond simple video downloading.

Content

Scanner excerpt · scripts/main.py (reported line 27)May include surrounding context.

python
print(f"❌ {pkg_name} 未安装，开始自动安装...")
        try:
            # 执行安装命令
            subprocess.run(
                install_cmd,
                capture_output=True,
                text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/main.py (reported line 84)May include surrounding context.

python
"--quiet"  # 减少输出，避免日志过长
        ]
        try:
            subprocess.run(
                download_cmd,
                capture_output=True,
                text=True,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's docstrings, comments, argument descriptions, and runtime messages are consistently in Chinese, which imposes a specific language on users. There is no option to select another language or indication that the tool is intentionally limited to a Chinese-speaking audience.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.