Security audit
Security checks for vulnerabilities and agentic risk
This video skill needs review because troubleshooting can spend credits on additional renders without asking first.
Require a quote and your approval before additional diagnostic renders. Check existing runs first and preserve the same request key when retrying an uncertain response. For local installation, pin a reviewed package version; keep service credentials private and limit the credits available to the integration.
SKILL.mdFailure diagnostics instruct an additional paid render without a separate authorization gate
Following the fallback can incur an additional charge. If the original request succeeded but its response was lost, the fresh key prevents deduplication against that request.
The chunk contains no Clipwright interaction, quoting, video generation, or MP4 retrieval. UUID generation could support a larger workflow, but no such connection is present in the supplied code; its only demonstrated purpose materially differs from the description.
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
| Claude Code | `claude mcp add --transport http clipwright https://mcp.clipwright.io/mcp`, then `/mcp` in a session to sign in | verified live 2026-10-18 |
| Claude.ai, Claude Desktop | Customize → Connectors → Add custom connector, paste the URL | not yet verified live |
| ChatGPT | the URL as the remote MCP server of a plugin (OpenAI's guide "Connect and test your plugin") | not yet verified live |
| Cursor | `~/.cursor/mcp.json`: `{"mcpServers": {"clipwright": {"url": "https://mcp.clipwright.io/mcp"}}}` | not yet verified live |
| VS Code | `.mcp.json` at the workspace root: `{"mcpServers": {"clipwright": {"type": "http", "url": "https://mcp.clipwright.io/mcp"}}}` | not yet verified live |
| Gemini CLI | `gemini mcp add --transport http clipwright https://mcp.clipwright.io/mcp`, then `/mcp auth clipwright` | not yet verified live |
| Codex | `codex mcp add clipwright --url https://mcp.clipwright.io/mcp`, then `codex mcp login clipwright` | not yet verified live |
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
| Claude.ai, Claude Desktop | Customize → Connectors → Add custom connector, paste the URL | not yet verified live |
| ChatGPT | the URL as the remote MCP server of a plugin (OpenAI's guide "Connect and test your plugin") | not yet verified live |
| Cursor | `~/.cursor/mcp.json`: `{"mcpServers": {"clipwright": {"url": "https://mcp.clipwright.io/mcp"}}}` | not yet verified live |
| VS Code | `.mcp.json` at the workspace root: `{"mcpServers": {"clipwright": {"type": "http", "url": "https://mcp.clipwright.io/mcp"}}}` | not yet verified live |
| Gemini CLI | `gemini mcp add --transport http clipwright https://mcp.clipwright.io/mcp`, then `/mcp auth clipwright` | not yet verified live |
| Codex | `codex mcp add clipwright --url https://mcp.clipwright.io/mcp`, then `codex mcp login clipwright` | not yet verified live |
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
**Revoking.** The account holder revokes an app at
`https://app.clipwright.io/api-keys`, under **Connected apps**. Its next request
gets `401`. A connection lasts 90 days from approval and is not extended by
use: after that the app must sign in again. An access token lasts one hour;
clients renew it themselves.
**Files.** The hosted server cannot read files on the agent's machine, so
The installation command executes the mutable @latest release with automatic confirmation rather than a reviewed, fixed version. A compromised publisher account or malicious update could execute code with the agent's local permissions and access credentials available to the process; the author's prototype rationale does not remove this supply-chain risk.
This persistent MCP configuration launches an unpinned npm release and passes it the service API key. A compromised future release could therefore gain local code execution and the ability to misuse that key without a corresponding configuration review.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
2026-10-18). Only the first-party client clipwright-agent may use this flow:
curl -s https://mcp.clipwright.io/device/auth -d client_id=clipwright-agent \
--data-urlencode "scope=mcp:read mcp:write offline_access" \
--data-urlencode "resource=https://mcp.clipwright.io/mcp"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
direct SDK users never see them. The MCP tools are deliberately thin: `make_ugc`
returns as soon as the run starts, so a long render never blocks your turn.)
## 6. On failure — plain curl as a diagnosis splitter
If the MCP path does not get you to a playable video, hit the same public REST
directly with curl, bypassing MCP, SDK and CLI entirely. If curl gets through, the
The diagnostic fallback directly starts a paid render without quoting its price or obtaining specific approval for an additional diagnostic purchase. It also generates a fresh idempotency key each invocation, so repeated troubleshooting or an uncertain earlier response can produce additional billable runs rather than safely recovering the original request.
The summary repeats the instruction to execute @latest, reinforcing the same supply-chain exposure as the installation section. This is a duplicate occurrence of the unpinned dependency risk, not an independent exploit path.
No suspicious patterns detected.