ClawHub
Back to skill

Security audit

视频转操作指南

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its video-to-document purpose, but it needs review because it automatically installs unpinned packages and under-discloses remote license/token and transcript-processing data flows.

Review before installing. Use this only on videos and transcripts you are allowed to share or process. Expect remote license checks to xiaping.coze.site when using XIAPING_TOKEN, and avoid setting Anthropic/OpenAI keys unless you are comfortable sending transcript content to those providers. Prefer installing dependencies yourself from trusted, pinned sources instead of relying on the skill’s automatic install path.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
print("正在安装依赖...")
    
    # Python 依赖
    subprocess.run([sys.executable, "-m", "pip", "install", 
                   "faster-whisper", "pillow", "python-docx", "anthropic", "-q"])
    
    # npm 依赖
Confidence
72% confidence
Finding
subprocess.run([sys.executable, "-m", "pip", "install", "faster-whisper", "pillow", "python-docx", "anthropic", "-q"])

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"faster-whisper", "pillow", "python-docx", "anthropic", "-q"])
    
    # npm 依赖
    subprocess.run(["npm", "install", "docx", "-q"])
    
    print("依赖安装完成！")
Confidence
72% confidence
Finding
subprocess.run(["npm", "install", "docx", "-q"])

Tainted flow: 'user_token' from os.environ.get (line 44, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
return {"valid": False, "message": "请设置 XIAPING_TOKEN 环境变量"}
    
    try:
        response = requests.post(
            "https://xiaping.coze.site/api/skills/verify",
            headers={"Authorization": f"Bearer {user_token}"},
            json={"skill_id": SKILL_ID},
Confidence
96% confidence
Finding
response = requests.post( "https://xiaping.coze.site/api/skills/verify", headers={"Authorization": f"Bearer {user_token}"}, json={"skill_id": SKILL_ID},

Tainted flow: 'user_token' from os.environ.get (line 44, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
return False
    
    try:
        response = requests.post(
            "https://xiaping.coze.site/api/skills/consume",
            headers={"Authorization": f"Bearer {user_token}"},
            json={"skill_id": SKILL_ID},
Confidence
96% confidence
Finding
response = requests.post( "https://xiaping.coze.site/api/skills/consume", headers={"Authorization": f"Bearer {user_token}"}, json={"skill_id": SKILL_ID},

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The script is documented as a content-refinement utility, but it conditionally transmits transcript content to third-party LLM providers when API keys are present. That creates a real data-exposure risk because spoken transcripts may contain sensitive business, customer, or operational information, and users may not expect local processing to become external processing based only on environment configuration.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The file implements remote authorization, purchase prompts, token handling, and usage-consumption logic that are not disclosed by the skill description, which focuses on local video processing. Hidden or under-disclosed networked commercial controls increase trust and privacy risk, especially because they require transmitting a local token to a third-party domain.

Ssd 3

Medium
Confidence
97% confidence
Finding
User-provided transcript text is embedded directly into prompts and sent verbatim to external LLM APIs. If transcripts contain personal data, credentials spoken aloud, proprietary procedures, or customer information, this results in unintended third-party disclosure and increases privacy, compliance, and data-handling risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.