ClawHub
Back to skill

Security audit

WeChat Article Video

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed video-production workflow that uses local files, helper scripts, FFmpeg, and Edge TTS in ways that match its stated purpose.

Install only if you are comfortable with a skill that creates media project files, runs bundled Python scripts, calls FFmpeg/ffprobe, and uses Edge TTS for narration. Review user-supplied article and image rights separately, especially for medical or product claims.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs the agent to read and write local files and execute shell commands, but no permissions are declared to constrain or make those capabilities explicit. This creates a real security and governance gap: an agent may access or modify project files or run local tooling without transparent scoping, increasing the chance of unintended file access, destructive operations, or execution in the wrong workspace.

Static analysis

No suspicious patterns detected.