ClawHub
Back to skill

Security audit

iPlay

Security checks for vulnerabilities and agentic risk

Overview

This skill transparently opens user-provided media URLs in the local iPlay app and does not show hidden persistence, data access, or unrelated behavior.

Install this only if you use iPlay and are comfortable letting the agent open media links in that application. Treat links like normal media-player inputs: only play URLs you trust, especially on Windows where the helper should ideally avoid shell=True in a future version.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tool Parameter Abuse

High
Category
Tool Misuse
Content
subprocess.run(["open", iplay_uri], check=True)
        elif system == "Windows":
            # Fixed: Quote URI to prevent '&' being interpreted as command separator by shell=True
            subprocess.run(f'start "" "{iplay_uri}"', shell=True, check=True)
        else:  # Linux
            subprocess.run(["xdg-open", iplay_uri], check=True)
        print(f"Successfully sent URL to iPlay: {url}")
Confidence
95% confidence
Finding
This is a genuine tool-parameter abuse issue because untrusted input flows into a shell-executed command on Windows. In the context of an agent skill designed to open attacker-supplied media URLs, this is more dangerous than a local-only helper because the skill naturally processes external input and could be abused to trigger shell behavior beyond merely launching iPlay.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill invokes a local Python helper via shell but does not declare any tool scope or execution permissions, so the agent/runtime may allow broader execution than reviewers and policy expect. In a skill that opens arbitrary user-provided URLs in a desktop media player, this missing declaration reduces transparency and can hide risky behaviors such as launching local handlers or unreviewed subprocesses.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
system = platform.system()
    try:
        if system == "Darwin":  # macOS
            subprocess.run(["open", iplay_uri], check=True)
        elif system == "Windows":
            # Fixed: Quote URI to prevent '&' being interpreted as command separator by shell=True
            subprocess.run(f'start "" "{iplay_uri}"', shell=True, check=True)
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
subprocess.run(["open", iplay_uri], check=True)
        elif system == "Windows":
            # Fixed: Quote URI to prevent '&' being interpreted as command separator by shell=True
            subprocess.run(f'start "" "{iplay_uri}"', shell=True, check=True)
        else:  # Linux
            subprocess.run(["xdg-open", iplay_uri], check=True)
        print(f"Successfully sent URL to iPlay: {url}")
Confidence
92% confidence
Finding
On Windows, the code builds a shell command string from user-controlled input and executes it with shell=True. Although the URI is wrapped in double quotes and the URL is base64-encoded, an attacker can still exploit shell metacharacter handling if the constructed string can be broken or reinterpreted by cmd.exe semantics, making this a command-injection sink in a skill that accepts arbitrary URLs.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# Fixed: Quote URI to prevent '&' being interpreted as command separator by shell=True
            subprocess.run(f'start "" "{iplay_uri}"', shell=True, check=True)
        else:  # Linux
            subprocess.run(["xdg-open", iplay_uri], check=True)
        print(f"Successfully sent URL to iPlay: {url}")
    except Exception as e:
        print(f"Error opening iPlay: {e}", file=sys.stderr)
Confidence
70% confidence
Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.