ClawHub
Back to skill

Security audit

拆书成视频 Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed book-to-video generator, with expected network, file, and FFmpeg use for that purpose.

Install only if you are comfortable using ARK/Doubao and edge-tts for this workflow. Avoid sensitive or proprietary book notes/prompts, verify the output directory, and consider tightening triggers plus adding URL/content-size validation before production use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

Tainted flow: 'img_url' from requests.post (line 227, network input) → requests.get (network output)

Medium
Category
Data Flow
Content
if "data" in data and len(data["data"]) > 0:
                img_url = data["data"][0].get("url")
                if img_url:
                    img_data = requests.get(img_url, timeout=60).content
                    with open(output_path, "wb") as f:
                        f.write(img_data)
                    return True
Confidence
89% confidence
Finding
The code blindly fetches img_url returned by a remote API and downloads it without validating the scheme, host, content type, or size. If the upstream service is compromised or returns attacker-controlled URLs, the skill could be abused for SSRF-like outbound requests or unexpected large downloads into local storage.

Tainted flow: 'img_url' from requests.post (line 227, network input) → requests.get (network output)

Medium
Category
Data Flow
Content
if "data" in data and len(data["data"]) > 0:
                    img_url = data["data"][0].get("url")
                    if img_url:
                        img_data = requests.get(img_url, timeout=60).content
                        with open(output_path, "wb") as f:
                            f.write(img_data)
                        return True
Confidence
89% confidence
Finding
This earlier download path has the same issue: it treats a network-supplied URL as trusted and performs a second outbound request. In a media-generation skill that regularly contacts external services, this increases risk because the code will automatically retrieve arbitrary remote content and store it locally.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares substantial capabilities in its content and usage flow—environment-variable access, reading and writing files, network calls to external APIs, and shelling out to FFmpeg—but exposes no explicit permissions model. That creates a trust and review gap: users or orchestrators may invoke a skill with more power than is apparent, increasing the chance of unsafe execution or unintended data exposure.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README instructs users to provide an external ARK API key for image generation but does not clearly disclose that book titles, prompts, and related generated content may be transmitted to third-party services. This creates a privacy and data-handling risk because users may unknowingly send sensitive or proprietary reading lists, prompts, or derived content to external providers.

Vague Triggers

Medium
Confidence
85% confidence
Finding
Overly broad trigger phrases can cause the skill to activate for general video-related requests beyond its intended scope. Because this skill performs network access, file writes, and shell-based media rendering, accidental invocation increases the chance of unintended external requests, filesystem changes, or costly processing.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrase '书单号' is ambiguous and may match a wide range of unrelated social-media or content-production requests. In a skill that can write files, contact external services, and invoke FFmpeg, ambiguous activation broadens exposure and can lead to unintended execution in the wrong context.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The read_when conditions are broad and scope the skill to many loosely related requests, including bulk generation and generic AI video creation. This makes accidental or excessive activation more likely, which is riskier here because the workflow includes external API usage, environment-variable consumption, local file output, and shell execution.

Unvalidated Output Injection

High
Category
Output Handling
Content
output_path
        ]

    result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
    if result.returncode != 0:
        print(f"  ⚠️ FFmpeg 渲染失败: {result.stderr[-200:]}")
        return False
Confidence
91% confidence
Finding
The ffmpeg filter graph embeds text derived from model output and local JSON into drawtext expressions with only partial escaping. FFmpeg filter syntax is fragile; unescaped special characters, newlines, or crafted content can break parsing, alter filter behavior, or cause unexpected file/protocol references inside FFmpeg, which is particularly risky in a skill that processes remote model-generated content automatically.

Static analysis

No suspicious patterns detected.