ClawHub
Back to skill

Security audit

Wechat Article Video

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed video-production workflow that uses project files, local media tools, and Edge TTS in ways that fit its stated purpose.

Before installing, be aware that the skill will create project and release files, run Python/FFmpeg tooling, and may send voiceover text to Edge TTS. Use it with article text and images you are allowed to process, and review sensitive drafts before network TTS generation.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding
The skill instructs the agent to read and write project files and execute shell commands, but it does not declare permissions or constrain those capabilities. In an agent environment, this creates a real least-privilege and transparency problem: the runtime may allow broader filesystem or command execution than users expect, increasing the chance of unsafe file access, overwrites, or command misuse if the skill is invoked on untrusted inputs.

Static analysis

No suspicious patterns detected.