ClawHub
Back to skill

Security audit

English Learning Animation

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent animation-production helper whose local scripts and file writes match its stated video-creation purpose.

Install only if you are comfortable with a skill that runs local Python, ffmpeg/ffprobe, Remotion/Node tooling, and a local Qwen3-TTS checkpoint. Use a new or empty project directory, avoid pointing model or output paths at sensitive locations, and review generated assets before publishing.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs the agent to execute local Python scripts, use shell commands, read environment-dependent model paths, and read/write project files, but it does not declare corresponding permissions. This creates a trust and review gap: operators may invoke the skill without realizing it has code-execution and filesystem capabilities, increasing the risk of unintended file access, shell misuse, or environment data exposure.

Static analysis

No suspicious patterns detected.