ClawHub
Back to skill

Security audit

视频转操作指南

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its video-to-document purpose, but it needs review because it automatically installs unpinned packages and under-discloses remote license/token and transcript-processing data flows.

Review before installing. Use this only on videos and transcripts you are allowed to share or process. Expect remote license checks to xiaping.coze.site when using XIAPING_TOKEN, and avoid setting Anthropic/OpenAI keys unless you are comfortable sending transcript content to those providers. Prefer installing dependencies yourself from trusted, pinned sources instead of relying on the skill’s automatic install path.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
print("正在安装依赖...")
    
    # Python 依赖
    subprocess.run([sys.executable, "-m", "pip", "install", 
                   "faster-whisper", "pillow", "python-docx", "anthropic", "-q"])
    
    # npm 依赖
Confidence
72% confidence
Finding
The skill can automatically install Python packages at runtime without pinning versions or verifying hashes. This creates a software supply-chain risk: a compromised package, typosquatted dependency, or hostile package index configuration could execute arbitrary code during installation.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"faster-whisper", "pillow", "python-docx", "anthropic", "-q"])
    
    # npm 依赖
    subprocess.run(["npm", "install", "docx", "-q"])
    
    print("依赖安装完成！")
Confidence
72% confidence
Finding
Automatically running 'npm install docx' at execution time introduces unpinned third-party code into the environment. If the dependency or registry path is compromised, installation scripts or malicious packages could run with the user's privileges.

Tainted flow: 'user_token' from os.environ.get (line 44, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
return {"valid": False, "message": "请设置 XIAPING_TOKEN 环境变量"}
    
    try:
        response = requests.post(
            "https://xiaping.coze.site/api/skills/verify",
            headers={"Authorization": f"Bearer {user_token}"},
            json={"skill_id": SKILL_ID},
Confidence
96% confidence
Finding
The skill reads a bearer token from user input or the XIAPING_TOKEN environment variable and transmits it to an external domain for license verification. This is credential exfiltration from the local environment to a third-party service that is unrelated to the core video-to-document function, increasing sensitivity and user risk.

Tainted flow: 'user_token' from os.environ.get (line 44, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
return False
    
    try:
        response = requests.post(
            "https://xiaping.coze.site/api/skills/consume",
            headers={"Authorization": f"Bearer {user_token}"},
            json={"skill_id": SKILL_ID},
Confidence
96% confidence
Finding
This code again harvests the XIAPING_TOKEN environment variable and sends it in an Authorization header to an external service to decrement usage. Repeated remote transmission of local credentials for metering is risky and outside the stated purpose of converting videos to documentation.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The script is documented as a content-refinement utility, but it conditionally transmits transcript content to third-party LLM providers when API keys are present. That creates a real data-exposure risk because spoken transcripts may contain sensitive business, customer, or operational information, and users may not expect local processing to become external processing based only on environment configuration.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The file implements remote authorization, purchase prompts, token handling, and usage-consumption logic that are not disclosed by the skill description, which focuses on local video processing. Hidden or under-disclosed networked commercial controls increase trust and privacy risk, especially because they require transmitting a local token to a third-party domain.

Ssd 3

Medium
Confidence
97% confidence
Finding
User-provided transcript text is embedded directly into prompts and sent verbatim to external LLM APIs. If transcripts contain personal data, credentials spoken aloud, proprietary procedures, or customer information, this results in unintended third-party disclosure and increases privacy, compliance, and data-handling risk.

Static analysis

No suspicious patterns detected.