ClawHub
Back to skill

Security audit

video-understand

Security checks for vulnerabilities and agentic risk

Overview

This video-analysis skill is coherent, but its install instructions ask users to trust a mutable global npm CLI and even suggest a root install fallback.

Install only if you are comfortable trusting the external `video-understand` npm package and the Gemini or Kimi providers with the videos you analyze. Prefer environment variables for API keys, avoid `sudo npm install -g`, use a user-scoped Node setup or pinned reviewed package version, and delete provider-side uploads when no longer needed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
rules/install.md:5
Finding

Unpinned Third-Party CLI Installation with Privileged Fallback

Content
View full analysis
Remediation
View remediation
``` 2. Publish and verify package integrity information, such as the expected npm tarball integrity hash. 3. Remove the recommendation to run npm installation with `sudo`. 4. Recommend a user-scoped installation method, a version manager, or an isolated execution environment instead of a root-owned global installation. 5. Audit and document package lifecycle scripts before recommending the dependency. 6. Include the CLI source, a dependency lockfile, and reproducible build information in the reviewed project where practical. 7. Document the expected package publisher and official registry location to reduce dependency-confusion and package-spoofing risks. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

video-understand analyze video.mp4 "Describe" --json

Use a specific model

video-understand analyze video.mp4 "Describe" --model gemini-3-pro-preview video-understand analyze video.mp4 "Describe" --provider kimi --model kimi-k2.5

text

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

Use a specific model

video-understand analyze video.mp4 "Describe" --model gemini-3-pro-preview video-understand analyze video.mp4 "Describe" --provider kimi --model kimi-k2.5

text

**Default prompt** (if omitted): "Describe what happens in this video in detail."

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file documents a delete operation that removes uploaded files, but it provides no warning that the action is destructive or potentially irreversible. Under the markdown criteria for missing user warnings, destructive behaviors that could affect user data should be disclosed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instructions explicitly state that API keys can be saved to ~/.video-understand/config.json but do not warn users about the risks of storing long-lived credentials on disk, such as local disclosure via weak file permissions, backups, shared accounts, or malware. Because this is an install/auth guide, users are likely to follow it verbatim, making credential persistence a real security concern rather than a purely theoretical issue.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md
brew install yt-dlp

# Linux (Debian/Ubuntu)
sudo apt install yt-dlp

# Cross-platform (uv)
uv tool install yt-dlp

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · rules/install.md (reported line 67)May include surrounding context.

md
brew install yt-dlp

# Linux (Debian/Ubuntu)
sudo apt install yt-dlp

# Cross-platform (uv)
uv tool install yt-dlp

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
81% confidence
Finding

Recommending sudo npm install -g video-understand encourages running npm package installation with elevated privileges, which increases risk if the package or its install lifecycle scripts are compromised. In the context of third-party CLI installation, this is more dangerous because npm packages can execute install-time code, so root execution can lead to full system compromise.

Content

Scanner excerpt · rules/install.md (reported line 110)May include surrounding context.

md
- Supported: MP4, MPEG, MOV, AVI, FLV, MPG, WebM, WMV, 3GPP, MKV

**Permission denied on install**
- Use `sudo npm install -g video-understand` or fix npm permissions

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The markdown notes that Kimi requires yt-dlp to download a YouTube video first, which means external content is retrieved and likely written to disk. This behavior can affect bandwidth, storage, and user data handling, so the skill description should warn users before they enable or use this workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.