ClawHub
Back to skill

Security audit

专业对话稿生成助手

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent and disclosed: it downloads public Bilibili audio and uses Tencent Cloud ASR to produce speaker-labeled transcripts, with notable privacy and environment-change caveats.

Install only if you are comfortable sending the audio to Tencent Cloud and providing Tencent credentials. Use a separate Python environment, preinstall dependencies where possible, avoid sensitive or private recordings, keep credentials in environment variables or a private config file, rotate any key that appears in chat or files, and review output paths to avoid overwriting important files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (12)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
import requests
    except ImportError:
        try:
            subprocess.run(['python3', '-m', 'pip', 'install', 'requests'], 
                          check=True, capture_output=True)
        except subprocess.CalledProcessError:
            output_result({'ok': False, 'error': 'INSTALL_FAILED', 'message': '依赖安装失败'})
Confidence
98% confidence
Finding
subprocess.run(['python3', '-m', 'pip', 'install', 'requests'], check=True, capture_output=True)

Tainted flow: 'audio_url' from requests.get (line 99, network input) → requests.get (network output)

Medium
Category
Data Flow
Content
audio_url = best_audio['baseUrl']
        
        # 下载音频
        audio_response = requests.get(audio_url, headers=headers, stream=True, timeout=60)
        audio_response.raise_for_status()
        
        with open(output_path, 'wb') as f:
Confidence
93% confidence
Finding
audio_response = requests.get(audio_url, headers=headers, stream=True, timeout=60)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill instructs the agent to use shell, network, environment variables, and file writes but does not declare any permissions or present a least-privilege boundary. This creates a trust gap where a caller may not realize the skill can install packages, access secrets, download remote content, and write artifacts locally, increasing the chance of unsafe execution in a broader agent environment.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill description emphasizes transcript generation from Bilibili content, but the body also performs dependency installation and uploads audio to Tencent COS/ASR, which are materially different behaviors with security and privacy consequences. Users may supply audio or credentials without understanding that third-party cloud transmission and local environment modification will occur.

Description-Behavior Mismatch

High
Confidence
96% confidence
Finding
The skill advertises speaker-labeled transcript generation, but the code only queries Bilibili metadata and downloads audio. This capability mismatch is security-relevant because it obscures the actual data flows and side effects, making users more likely to authorize network access and file writes they would not expect from a transcription helper.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The initialization path invokes subprocesses and performs package installation, which exceeds the minimally expected behavior for a subtitle/dialogue-script helper and increases the skill's execution privileges and environmental impact. In context, this is more dangerous because the public description does not prepare users for system modification during initialization.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The module docstring describes an audio download tool, while the skill metadata claims a professional speaker-labeled transcript generator. This inconsistency is a trust and transparency problem that can conceal the true behavior of the skill and reduce informed consent around downloading media from external services.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill describes downloading audio and sending it, along with cloud credentials usage, to external Tencent services, but the warning is not sufficiently prominent relative to the operational steps. This can lead to unintended disclosure of audio content or mishandling of secrets, especially in agent-driven workflows where users may not read the full procedure carefully.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The run flow uploads local audio to Tencent COS and submits it to Tencent ASR without any explicit runtime consent, warning, or confirmation. Because audio often contains sensitive personal, corporate, or regulated data, silent third-party transfer creates a real privacy and compliance risk in this skill context.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
Installing dependencies automatically without warning or confirmation is a meaningful security issue because it performs network retrieval and environment modification on behalf of the user. Package installation may execute installer logic and can create persistence or break host integrity even when the requested package appears benign.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill writes downloaded content directly to `output_path` without an explicit overwrite check or user-facing warning, so it can silently create or replace files in the current working directory or an arbitrary caller-supplied path. In a tool presented as a dialogue-script assistant, this side effect is more risky because users may not expect raw media file writes.

Unvalidated Output Injection

High
Category
Output Handling
Content
import requests
    except ImportError:
        try:
            subprocess.run(['python3', '-m', 'pip', 'install', 'requests'], 
                          check=True, capture_output=True)
        except subprocess.CalledProcessError:
            output_result({'ok': False, 'error': 'INSTALL_FAILED', 'message': '依赖安装失败'})
Confidence
91% confidence
Finding
subprocess.run(['python3', '-m', 'pip', 'install', 'requests'], check=True, capture_output

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/run.js:15