ClawHub
Back to skill

Security audit

Audio Stream Upload

Security checks for vulnerabilities and agentic risk

Overview

This skill is an audio upload helper, but it gives broad agent permissions and sends local files and API keys to a hardcoded external service without enough user-facing control or trust guidance.

Install only if you intentionally want this agent to upload selected audio files and metadata to the shown external service. Verify who controls that service, use narrowly scoped revocable API keys, avoid confidential recordings unless the service is approved for them, and do not run the workflow as administrator.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

other

Error
Location
SKILL.md:117
Finding

Transmission of Local Audio Files and API Credentials to an Unverified External Service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 117-145
Vulnerability Type: Sensitive Data Exfiltration
Risk Level: High

python
class AudioBatchUploader:
    def __init__(self, public_key, secret_key, max_workers=3):
        self.public_key = public_key
        self.secret_key = secret_key
        self.base_url = 'https://api-w3stream.attoaioz.cyou/api'
        self.max_workers = max_workers
        self.results = []
        self.failed = []

    @property
    def headers(self):
        return {
            'stream-public-key': self.public_key,
            'stream-secret-key': self.secret_key
        }

    def upload_single(self, file_path, title, config=None):
        """Upload one audio file with custom encoding configuration."""
        try:
            create_data = {'title': title, 'type': 'audio'}
            if config:
                create_data.update(config)
            resp = requests.post(
                f'{self.base_url}/videos/create',
                headers={**self.headers, 'Content-Type': 'application/json'},
                json=create_data
            )
            audio_id = resp.json()['data']['id']
            file_size = os.path.getsize(file_path)
            with open(file_path, 'rb') as f:
                file_hash = hashlib.md5(f.read()).hexdigest()
            with open(file_path, 'rb') as f:
                requests.post(
                    base_url}/videos/{audio_id}/part',
                    headers={
                        **self.headers,
                        'Content-Range': f'bytes 0-{file_size-1}/{file_size}'
                    },
                    files={'file': f},
                    data={'index': 0, 'hash': file_hash}
                )

Additional credential-transmission example at SKILL.md:303-305:

bash
curl -s -X POST 'https://api-w3stream.attoaioz.cyou/api/videos/create' \
  -H 's
...[truncated 2210 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not hardcode the upload destination. Require an explicitly configured endpoint and display its hostname before transmitting data.
  2. Restrict destinations through an allowlist controlled by the user or deployment administrator.
  3. Require informed confirmation before the first upload, clearly identifying the destination and the files and metadata that will be transmitted.
  4. Document service ownership, jurisdiction, retention periods, deletion procedures, subprocessors, and privacy protections.
  5. Use narrowly scoped, revocable upload tokens instead of broadly reusable secret keys.
  6. Prevent credentials from being forwarded across redirects; reject cross-origin redirects and unexpected hostnames.
  7. Validate TLS certificates and hostnames, set explicit timeouts, and fail closed on certificate errors.
  8. Add file-type, size, and path validation so only files explicitly selected by the user can be read.
  9. Avoid logging credentials, request headers, local paths, or sensitive server responses.
  10. Provide private-deployment or customer-controlled storage options for confidential enterprise recordings.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:439
Finding

Unnecessary Recommendation to Run the Upload Workflow with Administrator Privileges

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 439 and 459
Vulnerability Type: Excessive Privilege Guidance
Risk Level: Medium

text
| Insufficient permissions | The current user lacks read/write permissions | Check file permissions and run as administrator |

The same recommendation appears in both error-recovery sections at lines 439 and 459.

Technical Analysis

The declared operation only requires network access and read access to files deliberately selected for upload. It does not legitimately require administrator or system-wide privileges. Advising users to elevate the entire Agent or uploader when a file cannot be accessed violates least-privilege principles.

Elevation expands the set of readable files, writable locations, accessible credentials, and system resources available to the process. It also magnifies the consequences of defects in the skill, its mutable dependency, or the external-service workflow.

Attack Path

  1. The upload workflow encounters a permission error while accessing a file or directory.
  2. The user follows the documented recovery advice and reruns the Agent or command as an administrator.
  3. The process gains access to files and system resources beyond those required for an audio upload.
  4. A compromised dependency, malicious modification, or unsafe follow-on command executes within the elevated process.
  5. The attacker can access or modify resources that were unavailable under the original user account.

Impact Assessment

The precise impact depends on the operating system and elevation method. Potential access includes protected local files, credentials belonging to other accounts, system configuration, privileged installation locations, and system-wide write access. The recommendation does not itself perform elevation, but it creates a documented path for users to grant unnecessary privileges to the complete workflow.

Remediation
View remediation

Remediation Suggestions

  1. Remove all recommendations to run the Agent, Python interpreter, or upload workflow as an administrator.
  2. Require only read access to files explicitly selected for upload.
  3. When access fails, instruct users to choose a file they own or grant narrowly scoped read permission to that specific file.
  4. Do not recursively change directory permissions or ownership.
  5. Run the uploader in a sandbox or dedicated unprivileged account with no access to unrelated user or system files.
  6. If temporary storage is required, use a private per-user directory with restrictive permissions.
  7. Add an explicit runtime check that refuses execution under root or administrator privileges unless a separately reviewed deployment requirement exists.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:368
Finding

Unpinned Runtime Installation of a Security-Sensitive Network Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 368
Vulnerability Type: Insecure Dependency Management
Risk Level: Medium

bash
pip install requests

Technical Analysis

The installation command retrieves the latest version satisfying the package name at execution time. It does not specify an audited version, package hash, lock file, isolated environment, or trusted package index. Consequently, installations are not reproducible and may change after the skill has been reviewed.

The dependency operates in a security-sensitive context: it handles the remote connection, API secret headers, metadata, and local audio contents. A compromised package release, package-index compromise, or unsafe index configuration could therefore obtain all data available to the upload process.

The package name shown is not evidence of typosquatting or a currently malicious package. The confirmed issue is the absence of dependency pinning and integrity controls.

Attack Path

  1. A user follows the skill instructions and executes the unpinned pip install requests command.
  2. Package resolution uses the user's configured index and retrieves whatever release is current at that time.
  3. A compromised release, index, mirror, or dependency is installed into the environment.
  4. The malicious component executes during installation or when imported by the uploader.
  5. It reads API credentials, local audio data, or other resources accessible to the Python process and transmits or alters them.

Impact Assessment

Malicious dependency code would execute with the privileges of the user running pip or the uploader. It could access the API keys and every audio file processed by the skill. If combined with the skill's administrator-execution recommendation, the potential scope could expand to protected system resources and system-wide package locations.

Remediation
View remediation

Remediation Suggestions

  1. Pin requests and all transitive dependencies to reviewed versions.
  2. Supply a lock file or hash-verified requirements file and install with hash enforcement.
  3. Use an explicitly configured trusted package index rather than inheriting arbitrary global index settings.
  4. Install dependencies inside a dedicated virtual environment under an unprivileged account.
  5. Perform dependency vulnerability and provenance scanning as part of release preparation.
  6. Review and deliberately update pinned versions on a controlled schedule.
  7. Avoid installation-time scripts or additional packages that are unnecessary for the documented upload functionality.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description claims broad media-processing capabilities such as video processing, audio editing, media conversion, and voice generation, but the implementation shown only performs upload workflows. This mismatch can cause an agent or operator to invoke the skill in contexts far outside its actual function, increasing the risk of unintended file handling, overbroad permissions, and unsafe trust in undocumented behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The activation language is broad enough to match many unrelated media tasks, despite the skill primarily implementing upload behavior. In agent environments, overly broad routing criteria can cause this skill to be selected for tasks involving local media files or transformations, leading to accidental external transmission or misuse of higher-risk tools.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is presented as an audio upload tool, yet its declared toolset includes generic exec, and later documentation explicitly promotes command execution capability. That creates unnecessary privilege scope and increases the chance the agent will run arbitrary shell commands unrelated to audio upload, which can lead to host compromise, file access, or data exfiltration if invoked by prompt injection or user confusion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The examples upload local audio files, metadata, and authentication headers to a third-party endpoint, but the documentation does not prominently warn users that local content and metadata leave the system. In an agent setting, this is dangerous because operators may assume the skill performs local processing, resulting in unintentional disclosure of proprietary or sensitive media and metadata.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This code performs external transmission of user-supplied metadata, API credentials in headers, and subsequent file content to a remote service. External transmission is the core purpose of an upload skill, but it remains security-relevant because the documentation does not clearly frame the privacy, trust, and consent implications, making accidental exfiltration of sensitive local media more likely.

Content

Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.

md
create_data = {'title': title, 'type': 'audio'}
            if config:
                create_data.update(config)
            resp = requests.post(
                f'{self.base_url}/videos/create',
                headers={**self.headers, 'Content-Type': 'application/json'},
                json=create_data

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The configuration example sets "language": "zh" as a fixed value, and similar locale-specific content appears elsewhere, but the skill does not state that it is a China-specific or Chinese-only workflow. This can violate language/locale policy because it imposes a locale default without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The large-file upload example sends file chunks and associated metadata to the same external service. Because chunked upload can transmit very large local files with minimal user visibility once started, the risk of unintended disclosure is substantial if the skill is triggered in the wrong context or by a user who does not realize data is leaving the environment.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

md
def upload_large_file(self, file_path, title, chunk_size=10*1024*1024):
    """分片上传大文件，支持断点续传"""
    file_size = os.path.getsize(file_path)
    resp = requests.post(f'{self.base_url}/videos/create',
headers, 'Content-Type': 'application/json'},
        json={'title': title, 'type': 'audio'})
    audio_id = resp.json()['data']['id']

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The curl example explicitly demonstrates sending metadata and API keys to a third-party endpoint. Although expected for an upload workflow, publishing network-exfiltrating examples without strong user-facing warnings or trust guidance can normalize unsafe handling of sensitive media and secrets, especially in agent-assisted execution contexts.

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

场景二：专业音乐多版本发布

音乐制作团队上传同一作品的不同质量版本，适配不同播放场景.

bash
curl -s -X POST 'https://api-w3stream.attoaioz.cyou/api/videos/create' \
  -H 'stream-public-key: YOUR_PUBLIC_KEY' \
  -H 'stream-secret-key: YOUR_SECRET_KEY' \
  -H 'Content-Type: application/json' \

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The curl example includes "language": "zh" in the audio configuration, again forcing a specific language setting in a general-purpose skill. There is no surrounding guidance that asks the user to choose a locale or explains why Chinese is mandatory for this workflow.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documented input/output schema describes a generic content-processing interface and reviewer-style result format that does not match the upload-oriented code. This contract confusion can mislead orchestration layers into sending arbitrary content or expecting sanitized local processing, when the skill actually transmits data externally, increasing the chance of privacy mistakes and unsafe automation decisions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The feature list advertises file writing and sandboxed command execution even though the example implementation only reads files and performs API uploads. Overstating capabilities encourages unnecessary tool permissions and can cause agents to assume it is acceptable to write arbitrary files or execute commands, enlarging the attack surface beyond the stated business purpose.

Content

No source excerpt is available for this finding.