ClawHub
Back to skill

Security audit

Video pusher

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent social-media publishing helper, but it needs Review because it stores live browser sessions locally and has unsafe profile-management behavior.

Install only if you are comfortable with the skill keeping logged-in browser profiles on disk for your social accounts. Before use, add profile/ to .gitignore or store profiles outside the repo, avoid sharing or archiving the project directory, use a separate browser/profile for automation, and be careful with delete/remove because profile cleanup can remove stored sessions and currently lacks strong path containment safeguards.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
skills/vp-accounts/vp_accounts.py:75
Finding

Index-Based Profile Allocation Can Reassign Authenticated Sessions to Another Account Group

Content
View full analysis
Remediation
View remediation
/` rather than `group_`. 3. Persist the immutable identifier in `accounts.json` and never regenerate it when groups are reordered. 4. During group deletion, explicitly ask whether associated profiles should be securely deleted or retained. 5. Detect and reject profile-directory collisions before launching Chromium. 6. Migrate existing profiles by mapping each current account record to a newly generated identifier. 7. Add regression tests covering deletion of the first, middle, and last groups followed by creation of new groups. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
skills/vp-accounts/vp_accounts.py:196
Finding

Unvalidated Profile Paths Permit Filesystem Operations Outside the Profile Directory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skills/vp-accounts/SKILL.md:125
Finding

Persistent Browser Credentials Are Stored in the Repository Without the Documented Ignore Protection

Content
View full analysis
/group_/` - The `profile/` directory has been added to `.gitignore` and will not be committed to Git ``` ### Technical Analysis The audited project tree does not contain a `.gitignore` file, despite the explicit statement that `profile/` is ignored. The application launches persistent Chromium contexts in this directory. Persistent browser profiles can contain cookies, local storage, authentication tokens, browsing state, and other session material sufficient to reuse logged-in social-media accounts. Users are therefore told that sensitive state is protected from Git commits when the claimed protection is absent. If the project directory is committed, archived, synchronized, or shared, the generated profile data may be included. ### Attack Path 1. A user follows the documented login workflow. 2. The scripts create persistent profiles under the repository-local `profile/` directory. 3. The profiles acquire authenticated cookies and platform session data. 4. The user relies on the documentation's statement that the directory is ignored. 5. The user runs a broad Git add operation, packages the project, or synchronizes the directory. 6. The profile data is disclosed to another party. 7. That party may reuse still-valid session state to access the associated accounts. ### Impact Assessment Disclosure can expose active sessions for Douyin, Xiaohongshu, WeChat Channels, Threads, and Instagram. Depending on platform controls and session validity, an attacker could access account data or act as the affected user. The issue affects credentials generated after use rather than secrets already pr ...[truncated 37 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
skills/vp-accounts/vp_accounts.py:2
Finding

Open-Ended Runtime Dependency Resolution Creates Supply-Chain and Reproducibility Risk

Content
View full analysis
=3.8" # dependencies = [ # "playwright>=1.40", # ] # /// ``` The root Skill also directs installation through mutable dependency resolution: ```yaml install: - id: uv kind: uv package: uv bins: ["uv"] label: "Install uv (Python package manager)" - id: playwright-chromium kind: shell command: "uv run playwright install chromium" label: "Install Chromium browser (~150MB, required for automation)" ``` ### Technical Analysis Each Python script declares `playwright>=1.40`, allowing any later release satisfying that lower bound. The audited project contains no dependency lockfile or integrity hashes. When a script is executed in a fresh environment, `uv` may resolve and install a package version different from the one reviewed or tested by the project author. Third-party package installation executes code with the invoking user's privileges and can change behavior independently of changes to this repository. No evidence was found that the package name is typosquatted or intentionally malicious. The issue is the absence of version and artifact integrity controls, which creates avoidable supply-chain exposure and non-reproducible execution. ### Attack Path 1. Run one of the Skill scripts in an environment where the declared dependency is not already installed. 2. `uv` resolves the open-ended `playwright>=1.40` requirement from the configured package index. 3. A future, compromised, or otherwise unexpected compatible version is downloaded. 4. Installation or import executes third-party code with the user's privileges. 5. Th ...[truncated 525 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill invokes shell commands and Python scripts that can install software, write profiles, modify account/session state, and publish content, yet it declares no explicit tool scope or permissions boundary. Without an allowlist, an agent/runtime may grant broader-than-necessary capabilities, increasing the chance of unintended file modification or command execution beyond what the user expected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
72% confidence
Finding

The natural-language instructions define the assistant role entirely in Chinese and do not offer any opt-in or alternative language behavior. Per the policy rule, forcing a specific language without user choice can be a locale/language policy violation unless clearly justified as region-specific and documented as such.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill states that it will automatically clean browser Singleton lock files and retry when profiles are occupied, but does not warn that this changes local browser/profile state. Deleting lock files can interfere with active browser sessions, risk profile corruption, or destroy session integrity, especially if another Chromium instance is legitimately using that profile.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill exposes destructive commands like delete and remove that erase account groups, local sessions, and browser profile data, but the referenced section does not clearly warn about that data loss at the point of use. In an agent setting, unclear destructive semantics can cause accidental credential/session deletion or loss of configured publishing accounts, especially when the agent acts on brief user instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The high-level description says the skill publishes to Douyin but does not prominently warn that it will automatically upload a local video and populate browser fields with title/body/tags. This reduces informed consent and increases the chance a user authorizes or triggers the skill without realizing local content will be transmitted to a third-party platform.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger condition '当用户要求发布视频到抖音时触发' is broad enough that ordinary user requests about Douyin publishing could invoke the skill without a strong confirmation boundary. Because this skill performs real-world browser automation and uploads a local file, accidental triggering can cause unintended disclosure or posting preparation on a live account.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · skills/vp-accounts/vp_accounts.py (reported line 184)May include surrounding context.

python
print("\n✅ 内容填写完毕！请检查后点击【发布】按钮")
        print("Close the browser window when done.")
        try:
            page.wait_for_event("close", timeout=0)
        except Exception:
            pass

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · skills/vp-publish-douyin/publish_douyin.py (reported line 112)May include surrounding context.

python
print("\n✅ 内容填写完毕！请检查后点击【发布】按钮")
        print("Close the browser window when done.")
        try:
            page.wait_for_event("close", timeout=0)
        except Exception:
            pass

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · skills/vp-publish-ins/publish_ins.py (reported line 128)May include surrounding context.

python
print("\n✅ 内容填写完毕！请检查后点击【发布】按钮")
        print("Close the browser window when done.")
        try:
            page.wait_for_event("close", timeout=0)
        except Exception:
            pass

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · skills/vp-publish-shipinhao/publish_shipinhao.py (reported line 119)May include surrounding context.

python
print("\n✅ 内容填写完毕！请检查后点击【发布】按钮")
        print("Close the browser window when done.")
        try:
            page.wait_for_event("close", timeout=0)
        except Exception:
            pass

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · skills/vp-publish-xhs/publish_xhs.py (reported line 124)May include surrounding context.

python
print("\n✅ 内容填写完毕！请检查后点击【发布】按钮")
        print("Close the browser window when done.")
        try:
            page.wait_for_event("close", timeout=0)
        except Exception:
            pass

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger condition is broad enough that normal user requests about Instagram posting could activate this skill unexpectedly, causing the agent to initiate an external publishing workflow without sufficiently explicit user intent. In this skill’s context, the risk is higher than a generic false trigger because it leads to account-scoped social media actions and browser automation tied to logged-in publishing sessions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The module description is written in Chinese, and several user-facing prompts later in the file are also Chinese-only. This imposes a specific language on users without any opt-in or documented locale constraint, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger text says the skill should activate whenever the user asks to publish to 视频号, which is broad enough to match many ordinary publishing requests without strong confirmation of scope, target account, or user intent. In a multi-platform publishing suite tied to persisted login state, this increases the chance of accidental invocation and unintended posting from an already-authenticated account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The script unconditionally deletes Chromium profile lock files before launching a persistent context. In an account-management/publishing skill that reuses authenticated browser profiles, this can corrupt profile state or interfere with another live browser session, potentially causing session loss or unintended account behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The argparse description and --title help text explicitly claim 微信视频号 has no separate title field and that the title is prepended to the body text. In actual behavior, the script locates a dedicated title input (input[placeholder*="概括视频主要内容"]) and fills it with title, while the description body is handled separately and does not prepend the title.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger condition is very broad: any user request to publish content to Threads can invoke a skill that performs real account-backed posting actions. Without tighter scope checks such as confirmation, authorization, or content/source validation, the agent may initiate unintended publishing flows or assist misuse on a connected social account.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This file contains user-facing operational messages such as login and manual posting instructions in Chinese, while the command-line interface description is in English. For users who do not read Chinese, critical steps may be inaccessible, which is a language-policy issue when no language choice or documented locale scope is provided.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
78% confidence
Finding

Using page.wait_for_event("close", timeout=0) causes the script to wait indefinitely for the browser window to close, which can leave the process and browser context running without bounds. In this skill's context, that can tie up local system resources or cause automation jobs to hang, especially if invoked non-interactively or as part of a larger workflow.

Content

Scanner excerpt · skills/vp-publish-threads/publish_threads.py (reported line 138)May include surrounding context.

python
print("\n✅ 内容填写完毕！请检查后点击【发帖】按钮")
            print("Close the browser window when done.")
            try:
                page.wait_for_event("close", timeout=0)
            except Exception:
                pass
        except Exception:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger condition is broad enough that ordinary user requests to post on Xiaohongshu could invoke this skill without strong confirmation of scope, target account group, or publication intent. Because the skill automates media upload and content entry into a real publishing flow, accidental or premature invocation could lead to unintended posting actions or disclosure of local media to the platform before the user notices.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger condition is broad enough that ordinary user requests about publishing or account management could invoke this skill without strong scoping or confirmation. Because the skill can check account state and initiate automated posting across multiple platforms, accidental invocation could lead to unintended browser automation, privacy exposure, or unintended content publication.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The module docstring is Chinese-only, and several user-facing runtime messages are also hardcoded in Chinese, indicating a fixed locale experience. The file does not offer any user opt-in or language selection to accommodate other locales.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.