ClawHub
Back to skill

Security audit

专业对话稿生成助手

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its transcription purpose, but it sends audio to Tencent Cloud, handles cloud credentials, modifies the Python environment, and leaves important privacy and safety controls under-scoped.

Review before installing. Use only non-sensitive or approved-for-cloud audio, prefer least-privilege Tencent credentials from environment variables, delete COS objects after ASR, avoid storing SecretKey in the skill directory, run dependency installation only in an isolated environment, and restrict outputs to a known workspace path.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T08 · Insecure Dependencies

Warning
Location
scripts/bilibili_skill.py:148
Finding

Unpinned Runtime Dependency Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/asr_transcribe.py:366
Finding

HTML Injection in Generated Transcript

Content
View full analysis
' f'{name}' f'{fmt_time(st)}' f'
{txt}
' ) html_parts.append("") with open(out_html, "w", encoding="utf-8") as f: f.write("\n".join(html_parts)) ``` ### Technical Analysis The generated HTML directly interpolates two values without HTML escaping: - `name`, derived from the caller-controlled `--speaker-map` argument. - `txt`, derived from `asr_result_detail.json` and ultimately from ASR output or a locally supplied result file. Characters such as `<`, `>`, `&`, single quotes, and double quotes are not encoded. A crafted value can therefore terminate the intended element and inject arbitrary HTML. Depending on how the output is opened or imported, this can include JavaScript event handlers, misleading links, forms, remote resources, or other active content. The fixed `color` values are selected internally and are not attacker-controlled, but this does not protect the unescaped speaker name and transcript body. ### Attack Path 1. An attacker influences the speaker-map value, transcript source, or `asr_result_detail.json`. 2. The attacker places an HTML payload in `name` or `FinalSentence`, for example an element containing an event handler. 3. The user runs the `build` command. 4. The script inserts the payload verbatim into `dialogue.html`. 5. The user opens the generated HTML in a browser or imports it into an HTML-capable editor. 6. The injected markup renders and may execute in that context. ### Im ...[truncated 515 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/asr_transcribe.py:45
Finding

Plaintext Long-Lived Cloud Credential Configuration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/asr_transcribe.py:126
Finding

Uploaded Audio Is Retained Indefinitely in Cloud Storage

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (26)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

代码的核心能力与“音频转写+说话人分离+生成基础对话稿”基本一致，这部分与描述相符；但声明中的多个重要卖点没有在代码中体现，尤其是 B 站输入支持、Clean Verbatim 重排、金句高亮、公众号可直接粘贴等。这些不是底层实现细节，而是面向用户的关键功能承诺。另一方面，代码还会访问腾讯云 COS/ASR 服务并需要相关凭证，虽属实现所需，但声明中的“Declared permissions: []”未反映外部云资源访问。综合来看，描述明显夸大了已实现功能，属于实质性不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

声明描述的核心能力是“专业对话稿生成”，重点在转录与文本加工；而代码的核心行为只是调用 B 站 API 获取视频信息和下载音频流。虽然声明中提到“支持 B 站视频作为输入源（下载音频、查询信息）”，这部分与代码一致，但这只是整个宣称能力中的前置/辅助环节。代码完全缺失最关键的转写与编辑输出能力，因此存在明显的描述与行为不一致，且实际主用途更接近‘B站音频下载工具’而非‘对话稿生成助手’。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest describes a 'professional dialogue transcript generator' with speaker labeling, clean-verbatim restructuring, quote highlighting, and publish-ready output. This file's actual behavior is limited to querying Bilibili video info and downloading an audio stream, with no transcription, diarization, text processing, or dialogue generation logic anywhere in the code.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares and instructs use of powerful capabilities—shell execution, network access, environment variable handling, and file writes—without any explicit tool-scope or permission boundaries. In an agent setting, this expands the blast radius of prompt misrouting or malicious input, because the skill can trigger downloads, cloud uploads, and local writes with no declared least-privilege constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill downloads media, uploads derived audio to Tencent Cloud, consumes secrets, and writes multiple artifacts, yet the risk disclosures are fragmented and easy to miss. In this context, insufficient up-front notice can lead users to unknowingly transmit third-party content and credentials to external services, increasing privacy, compliance, and secret-handling risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

L053 将“字幕”“转写”“文字稿”“对话稿”“逐字稿”等泛化词汇都作为触发条件，且未明确限定必须与 B 站输入或音频文件处理相关。这些词在很多普通对话、写作或总结场景中也常见，容易导致技能在非目标场景下被误判激活。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The document claims external parameters cannot override runtime behavior, yet earlier sections explicitly accept externally supplied output paths, result directories, and speaker mappings. This contradiction weakens trust assumptions and can lead integrators to under-sanitize inputs, creating opportunities for path manipulation, unsafe file placement, or unintended command argument injection depending on downstream script handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The example values for multiple fields are written only in Chinese, which imposes a specific language on users without any opt-in or indication that the skill is intended solely for a Chinese-speaking or region-specific audience. This matches the policy concern for language or locale constraints expressed in natural-language content.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/asr_transcribe.py (reported line 105)May include surrounding context.

python
if not os.path.exists(input_path):
        return {"ok": False, "error": "FILE_NOT_FOUND", "message": f"文件不存在: {input_path}"}
    try:
        subprocess.run(
            ["ffmpeg", "-y", "-i", input_path, "-ac", "1", "-ar", "16000",
             "-acodec", "libmp3lame", "-ab", "64k", output_path],
            check=True, capture_output=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script uploads local audio to Tencent COS and submits it to Tencent Cloud ASR, but the workflow does not provide an explicit consent gate or prominent warning at execution time that potentially sensitive audio leaves the local machine. In this skill context, users may process interviews, meetings, or podcasts that can contain personal or confidential information, so silent third-party transmission creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This code uploads arbitrary local audio to cloud storage and then creates a presigned GET URL valid for 24 hours, which expands access to the content beyond the local system. In the context of transcription of meetings/interviews, that can expose sensitive recordings if the bucket policy is too broad, the URL is logged/shared, or the object is not cleaned up after processing.

Content

Scanner excerpt · scripts/asr_transcribe.py (reported line 125)May include surrounding context.

python
config = CosConfig(Region=cfg["region"], SecretId=cfg["secret_id"],
                       SecretKey=cfg["secret_key"], Scheme="https")
    client = CosS3Client(config)
    client.upload_file(Bucket=cfg["bucket"], LocalFilePath=local_path, Key=cos_key, EnableMD5=True)
    url = client.get_presigned_url(Method="GET", Bucket=cfg["bucket"], Key=cos_key, Expired=86400)
    return url

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bilibili_skill.py (reported line 25)May include surrounding context.

python
def get_video_info(bvid):
    """获取视频信息"""
    url = f'https://api.bilibili.com/x/web-interface/view?bvid={bvid}'
    
    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bilibili_skill.py (reported line 65)May include surrounding context.

python
def get_video_info(bvid):
    """获取视频信息"""
    url = f'https://api.bilibili.com/x/web-interface/view?bvid={bvid}'
    
    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bilibili_skill.py (reported line 85)May include surrounding context.

python
def get_video_info(bvid):
    """获取视频信息"""
    url = f'https://api.bilibili.com/x/web-interface/view?bvid={bvid}'
    
    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',

Tainted flow: 'play_url' from requests.get (line 85, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/bilibili_skill.py (reported line 86)May include surrounding context.

python
# 获取播放地址
        play_url = f'https://api.bilibili.com/x/player/playurl?bvid={bvid}&cid={cid}&fnval=16&fnver=0&fourk=1'
        response = requests.get(play_url, headers=headers, timeout=10)
        play_data = response.json()
        
        if play_data['code'] != 0 or 'dash' not in play_data.get('data', {}):

Tainted flow: 'audio_url' from requests.get (line 99, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
89% confidence
Finding

The code fetches audio_url directly from upstream API response data and then performs a second request without validating the hostname, scheme, or content length. If the upstream response is compromised or manipulated, the skill could be induced to download unexpected content from arbitrary locations, enabling SSRF-like outbound access or large untrusted file retrieval.

Content

Scanner excerpt · scripts/bilibili_skill.py (reported line 102)May include surrounding context.

python
audio_url = best_audio['baseUrl']
        
        # 下载音频
        audio_response = requests.get(audio_url, headers=headers, stream=True, timeout=60)
        audio_response.raise_for_status()
        
        with open(output_path, 'wb') as f:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The initialization flow includes package installation via pip, which is broader and riskier than the stated purpose of querying Bilibili metadata and downloading audio. Runtime dependency installation modifies the environment and introduces avoidable supply-chain exposure, especially in automated agent contexts.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/bilibili_skill.py (reported line 142)May include surrounding context.

python
# 检查 Python 3
    try:
        subprocess.run(['python3', '--version'], check=True, capture_output=True)
    except (subprocess.CalledProcessError, FileNotFoundError):
        output_result({'ok': False, 'error': 'PYTHON_VERSION_2', 'message': '需要 Python 3'})
        return

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
93% confidence
Finding

The skill automatically executes pip to install a package at runtime without explicit user consent or strong integrity controls. This expands the trust boundary to package indexes and the local Python environment, creating supply-chain and environment-modification risk that is not necessary for a subtitle/download helper.

Content

Scanner excerpt · scripts/bilibili_skill.py (reported line 152)May include surrounding context.

python
import requests
    except ImportError:
        try:
            subprocess.run(['python3', '-m', 'pip', 'install', 'requests'], 
                          check=True, capture_output=True)
        except subprocess.CalledProcessError:
            output_result({'ok': False, 'error': 'INSTALL_FAILED', 'message': '依赖安装失败'})

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Automatically installing dependencies without warning or confirmation can surprise operators and alter the host environment in ways they did not authorize. In agent workflows, this can bypass normal review and increase the chance of unsafe package retrieval or operational drift.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The config sets "default_language" to "zh", which imposes a specific language by default. For an all-file-types policy check, this is a natural-language locale choice that lacks any indication of user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

文件整体将技能定位、触发规则、输出话术和错误提示都固定为中文，未看到向用户提供语言/locale 选择或明确的中文限定适用范围。对于通用技能，这种默认强制单一语言可能违反语言选择政策。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

L94 声称信息查询无需环境准备即可直接调用，但 L99 仍要求执行 node "$RUN_JS" info --bvid ...。而 RUN_JS 的定位步骤只在前面的环境准备章节中定义（L25-L29），因此“直接调用”与实际前置依赖并不一致。虽然这不一定带来额外能力风险，但属于文档与执行要求的直接偏差。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill writes the downloaded audio to a user-supplied or default path without checking whether the target file already exists, so it may overwrite files unexpectedly. This is not highly severe, but it can cause data loss or unintended file creation on disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file contains developer-facing natural-language comments exclusively in Chinese, which reflects a fixed language choice without any indication of user opt-in or documented locale constraint. Under the policy rule, forcing a specific language without choice or justification is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/run.js:15