ClawHub
Back to skill

Security audit

video-transcript

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a video subtitle extractor, but it needs review because it saves transcripts persistently and can accidentally output an unrelated prior transcript.

Install only if you are comfortable with the skill making network requests through `yt-dlp` and saving transcript files under your home directory. Treat it as a subtitle downloader, not a translator. Clear or isolate the transcript output directory between sensitive requests, and prefer a pinned `yt-dlp` version or a sandboxed environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:50
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
transcript.py:110
Finding

Cross-Request Transcript Disclosure Through Shared Output Directory

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

声明的核心能力是将视频链接转成文字讲稿，并对非中文视频提供原文+中文翻译。代码的实际行为是：解析 YouTube/Bilibili 链接，调用 yt-dlp 获取视频信息并下载已有或自动生成字幕，随后将 SRT 去时间轴转成纯文本保存与输出。这与“提取字幕生成文字稿”基本相关，但存在重要差异：首先，代码完全没有任何翻译逻辑，因此“非中文视频提供中文翻译”这一声明明显未兑现；其次，支持的平台在代码中仅限 YouTube 和 Bilibili，未体现更广泛的平台支持；再次，代码本质上依赖目标平台已有字幕或自动字幕，若无字幕则失败，因此它更准确地说是“下载并清洗字幕”，而不是通用的视频转文字转录工具。未发现与声明无关的明显额外敏感能力，但上述能力落差已构成描述与行为不一致。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill declares no explicit tool scope even though its documented workflow requires shell access and likely file operations via yt-dlp. Without a permissions or allowed-tools boundary, an agent may invoke broader capabilities than users expect, increasing the chance of unintended command execution or filesystem access if the skill is later implemented loosely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The activation criteria are broad enough that the skill may trigger on routine conversation containing a video link or general transcript request, causing unnecessary tool use or network access without clear user intent. Over-broad triggering increases the attack surface for prompt-injection content embedded in linked pages or subtitles and can lead to surprise actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Forcing Chinese translation/output for non-Chinese videos without user opt-in can cause unintended disclosure or transformation of user-requested content and may violate user expectations around fidelity, language preference, or data minimization. While not a severe exploit, it is a policy and consent issue that can lead to unnecessary processing of third-party content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The workflow explicitly mandates translation into Chinese for non-Chinese content, which hardcodes extra processing without consent or user choice. This expands data handling beyond the minimum needed to satisfy a transcript request and may create compliance or expectation issues, especially for sensitive or copyrighted material.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The title, description, usage messages, status output, and prompts are all hard-coded in Chinese, indicating the skill is intended to operate only in that language. The file does not offer any language selection or explain that it is a region- or locale-specific tool, which matches the language/locale policy concern for natural-language behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest says non-Chinese videos should provide both the original text and a Chinese translation. In this file, the workflow fetches subtitle files, strips SRT timing metadata, saves plaintext, and prints the original transcript only; there is no language detection, translation API call, or bilingual output generation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · transcript.py (reported line 45)May include surrounding context.

python
]
    
    print(f"正在下载字幕...")
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
    
    if result.returncode == 0:
        print("✓ 字幕下载成功")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · transcript.py (reported line 75)May include surrounding context.

python
"""获取视频信息"""
    cmd = ['yt-dlp', '--dump-json', '--no-download', url]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0:
            data = json.loads(result.stdout)
            return {