ClawHub
Back to skill

Security audit

video-shot-demos

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent video-demo generator, but its helper scripts contain real unsafe file and shell handling that can execute commands or write generated content outside the intended output area if given hostile inputs.

Review before installing or using on untrusted project plans. Use only trusted shot-list and plan JSON files, avoid attacker-controlled output filenames or browser paths, and prefer patching shot.js to use spawn/execFile argument arrays plus adding path containment and HTML escaping in init.js before production use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/shot.js:87
Finding

Shell Command Injection Through Screenshot Output Path

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/init.js:49
Finding

Arbitrary File Placement Through Unvalidated Project and Shot Identifiers

Content
View full analysis
'); const FORCE = args.includes('--force'); ``` ```js const outDir = path.resolve(root, plan.project); if (fs.existsSync(outDir)) { const exist = fs.readdirSync(outDir); if (exist.some(f => /^shot-.*\.html$/.test(f)) && !FORCE) die(`输出目录已存在且含 shot 页面: ${outDir}\n 如需追加/覆盖请加 --force（已有同名文件会被跳过，不会覆盖）`); } fs.mkdirSync(outDir, { recursive: true }); ``` ```js for (const a of plan.assign) { const fname = `shot-${a.id}_${safeName(a.title)}.html`; const fpath = path.join(outDir, fname); if (fs.existsSync(fpath)) { dupShots.push(fname); continue; } // ... fs.writeFileSync(fpath, html, 'utf8'); } ``` ### Technical Analysis The initializer treats fields from the plan JSON as trusted filesystem components. `plan.project` is passed directly to: ```js path.resolve(root, plan.project) ``` An absolute `project` value causes the supplied root to be discarded. A value containing `../` segments can similarly resolve outside the requested root. The shot identifier `a.id` is also inserted into a filename without validation. Although the title is processed by `safeName()`, the identifier is not. Slash characters and traversal sequences in `a.id` can therefore alter the final path produced by `path.join(outDir, fname)`. `plan.js` does not enforce the documented shot identifier format, and `init.js` can consume a manually created or modified plan without running `plan.js check`. The existing-file check only prevents overwriting an exact generated shot path; it does not prevent creation outside the intended output tree. Asset-copy operations may also write into an attacker-selected project directory. ### Attack Path 1. An attacker supplies or modifies a plan JSON consumed by `scripts/init.js`. 2 ...[truncated 1129 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/init.js:85
Finding

Stored Script Injection in Generated Shot Pages

Content
View full analysis
镜头 X-X · 【改成镜头标题】', `镜头 ${a.id} · ${a.title}`); html = html.replace(/const DUR=\d+;/, `const DUR=${Math.round(a.dur * 1000)};`); html = html.replace('镜头 X-X · 标题 · 12s', `镜头 ${a.id} · ${a.title} · ${a.dur}s`); html = html.replace('
0X / 章节名
', `
${chap} / ${plan.project}
`); html = html.replace('', `\n`); html = html.replace(/SHOT X-X<\/span>/, `SHOT ${a.id}`); fs.writeFileSync(fpath, html, 'utf8'); } ``` ### Technical Analysis Several values originating from a plan JSON are interpolated directly into HTML: - `a.id` - `a.title` - `a.dur` - `plan.project` - `a.style` - `a.fonts` - `a.palette` No context-sensitive escaping is applied. `safeName()` is only used for the filename derived from the title and does not sanitize the title inserted into HTML. A malicious title can terminate the `` element or injected `<span>` and add arbitrary markup or script. Metadata values can terminate the `shot-meta` comment with `-->` and inject active HTML before `</head>`. The duration is also inserted into JavaScript after numeric coercion, although invalid numeric handling is not robust. This is a stored injection issue: the malicious content is written into a generated page and ex ...[truncated 1528 chars]
Remediation
View remediation
/g, '>'); } ``` For attribute values, additionally escape quotation marks: ```js function escapeHtmlAttr(value) { return escapeHtmlText(value) .replace(/"/g, '"') .replace(/'/g, '''); } ``` Do not store untrusted metadata in an HTML comment. Use a non-executable JSON data block: ```html ``` Generate its content using `JSON.stringify()` and escape `<` as `\u003c` before insertion. Additional controls should include: 1. Validate shot IDs with `^\d+-\d+[a-z]?$`. 2. Require duration to be a finite positive number within a documented maximum. 3. Resolve style, font, and palette values from the trusted style database rather than accepting arbitrary plan values. 4. Validate project names as safe slugs. 5. Consider constructing the page through a templating mechanism with automatic escaping. 6. Apply a restrictive Content Security Policy to generated pages, avoiding inline scripts where practical. 7. Add regression tests using ``, ``, `-->`, `

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (95)

YARA rule 'php_webshell_generic': Generic PHP webshell — eval/assert on user-controlled input [webshells]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known webshell pattern (PHP, Python, JSP, or ASPX webshell).

Content

Scanner excerpt · assets/examples/glm-5.3-range-test/shot-2-7_路径穿越连跳四级.html (reported line 497)May include surrounding context.

html
"horseImg">
          <div class="lid">PNG</div>
          <div class="frame"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="3" width="18" height="18" rx="2"/><circle cx="9" cy="9" r="2"/><path d="M21 15l-5-5-9 9"/></svg></div>
        </div>
        <div class="phpCode">evil.png → 掀开盖子：&lt;?php system($_GET['cmd']); ?&gt;</div>
      </div>
    </div>
    <div id="jin3">一张图片，就能控制别人的电脑</div>

  </div><!-- /cam -->

  <!-- 固定 UI（不随镜头移动） -->
  <div id="posCard">
    <div class="lb">— 文件当前位置 · CURRENT —</div>
    <div id="posName">products / products</div>
  </div>
  <div id="pathBar">
    <div class="pv" id="pvNormal"><span class="seg">uploads/products/</span><span class="seg">SP001_20260815_</span><span class="seg okc">shell.png　✓ 老老实实待在 uploads 里</span></div>
    <div class="pv" id="pvEvil" style="opaci

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: video-shot-demos
description: 视频分镜演示动画生成技能：每个镜头产出一个独立 HTML（统一播放器底盘+每页不同视觉风格），覆盖风格分配、双角色立绘素材、口播时间轴对齐、批量截图质检与 index 总览的完整工具链。适用于制作技术实测、产品发布、课程、叙事类分镜演示视频。
AIGC:
    Label: "1"
    ContentProducer: 001191440300708461136T1XGW3
    ProduceID: 9db5aa32bb416ff6601e09a7b615dacc_ed36f1baab6a11f18874525400287e28
    ReservedCode1: u6yOsEv22jbdVtYRWeJaUyUlNn7iQVd5R+izu80cHEUl0QXQimpRoLP/V4lLT8wSetgDQwgxvKxuFrV

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
e":"...","dur":14,"brief":"震撼数字 事件宣告"}],"locks":[...]}`，格式见 plan.js 头注释）后 `node scripts/plan.js new 清单.json` 生成风格分配草表（自动校验：相邻不同风格 / 整辑不重复 / 实体锁色一致性），确认后 `node s

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md
e":"...","dur":14,"brief":"震撼数字 事件宣告"}],"locks":[...]}`，格式见 plan.js 头注释）后 `node scripts/plan.js new 清单.json` 生成风格分配草表（自动校验：相邻不同风格 / 整辑不重复 / 实体锁色一致性），确认后 `node s

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
scripts/plan.js new 清单.json` 生成风格分配草表（自动校验：相邻不同风格 / 整辑不重复 / 实体锁色一致性），确认后 `node scripts/init.js <清单同名>.plan.json --root <输出根目录>` 一步完成初始化：建输出目录 → 校验并复制双角色立绘 → 按分

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
scripts/plan.js new 清单.json` 生成风格分配草表（自动校验：相邻不同风格 / 整辑不重复 / 实体锁色一致性），确认后 `node scripts/init.js <清单同名>.plan.json --root <输出根目录>` 一步完成初始化：建输出目录 → 校验并复制双角色立绘 → 按分

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
scripts/plan.js new 清单.json` 生成风格分配草表（自动校验：相邻不同风格 / 整辑不重复 / 实体锁色一致性），确认后 `node scripts/init.js <清单同名>.plan.json --root <输出根目录>` 一步完成初始化：建输出目录 → 校验并复制双角色立绘 → 按分

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/doubao-paper-detective/index.html (reported line 100)May include surrounding context.

html
</div>
  </header>

  <!-- PART 1 -->
  <div class="part">
    <span class="no">PART 1</span><h2>冷开场</h2><span class="line"></span><span class="cnt">4 SHOTS · 64s</span>
  </div>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/doubao-paper-detective/shot-4-5_卡片墙越攒越好用.html (reported line 351)May include surrounding context.

html
</head>
<body>
<div id="stage">
  <!-- ================= 镜头世界 ================= -->
  <div id="cam">

    <!-- 标题缎带 + 计数器 -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/doubao-paper-detective/shot-5-1_三篇一条线与双结论.html (reported line 296)May include surrounding context.

html
<div id="cam">
    <div id="frame"></div>

    <!-- 地图底：幽灵线路 -->
    <svg id="mapSvg" viewBox="0 0 1920 1080">
      <g stroke="#e0dac8" stroke-width="5" fill="none" stroke-linecap="round">
        <path d="M0 430 H 420 L 700 150 H 1000"/>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/doubao-paper-detective/shot-5-1_三篇一条线与双结论.html (reported line 296)May include surrounding context.

html
<div id="cam">
    <div id="frame"></div>

    <!-- 地图底:幽灵线路 -->
    <svg id="mapSvg" viewBox="0 0 1920 1080">
      <g stroke="#e0dac8" stroke-width="5" fill="none" stroke-linecap="round">
        <path d="M0 430 H 420 L 700 150 H 1000"/>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/doubao-paper-detective/shot-5-2_指定句与三连.html (reported line 304)May include surrounding context.

html
<div id="cam">
    <div id="coffee"></div>

    <!-- 干花装饰 -->
    <svg id="flower" viewBox="0 0 340 220" fill="none" stroke-linecap="round">
      <path d="M40 200 C 90 150, 130 110, 190 60" stroke="#8a9464" stroke-width="4"/>
      <path d="M90 200 C 130 160, 180 130, 250 100" stroke="#9aa06e" stroke-width="3.5"/>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/glm-5.3-range-test/shot-1-2_三大基准阶梯.html (reported line 221)May include surrounding context.

html
</head>
<body>
<div id="stage">
  <!-- ================= 镜头世界 ================= -->
  <div id="cam">
  <div id="legend">
    <h1>测 AI 挖洞 · <em>三座高峰</em></h1>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/glm-5.3-range-test/shot-1-2_三大基准阶梯.html (reported line 221)May include surrounding context.

html
</head>
<body>
<div id="stage">
  <!-- ================= 镜头世界 ================= -->
  <div id="cam">
  <div id="legend">
    <h1>测 AI 挖洞 · <em>三座高峰</em></h1>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/glm-5.3-range-test/shot-2-11_Sol上场.html (reported line 324)May include surrounding context.

html
</head>
<body>
<div id="stage">
  <!-- ================= 镜头世界 ================= -->
  <div id="cam">
  <div class="win" style="left:220px"></div>
  <div class="win" style="left:560px"></div>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/glm-5.3-range-test/shot-2-12_Sol交卷与Mythos.html (reported line 286)May include surrounding context.

html
</head>
<body>
<div id="stage">
  <!-- ================= 镜头世界 ================= -->
  <div id="cam">
  <div class="spot" id="sp1" style="left:340px"></div>
  <div class="spot" id="sp2" style="right:340px"></div>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/glm-5.3-range-test/shot-2-4_超额退款.html (reported line 253)May include surrounding context.

html
</head>
<body>
<div id="stage">
  <!-- ================= 镜头世界 ================= -->
  <div id="cam">
  <div id="awning"></div>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/glm-5.3-range-test/shot-2-4_超额退款.html (reported line 253)May include surrounding context.

html
</head>
<body>
<div id="stage">
  <!-- ================= 镜头世界 ================= -->
  <div id="cam">
  <div id="awning"></div>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/glm-5.3-range-test/shot-2-7_路径穿越连跳四级.html (reported line 389)May include surrounding context.

html
<span class="lbl">靶场计分</span><b id="msTotal">950</b><small>/ 4800</small>
  </div>

  <!-- ================= 镜头世界 ================= -->
  <div id="cam">

    <div id="towerWrap">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/glm-5.3-range-test/shot-2-7_路径穿越连跳四级.html (reported line 479)May include surrounding context.

html
</div>
    </div>

    <!-- P3 危害延伸 -->
    <div id="extWall">
      <h3>扩展名黑名单 · 拦住了危险后缀</h3>
      <div class="extRow">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/glm-5.3-range-test/shot-2-9_翻车与幻觉.html (reported line 232)May include surrounding context.

html
</head>
<body>
<div id="stage">
  <!-- ================= 镜头世界 ================= -->
  <div id="cam">
  <div class="hole" style="top:200px"></div>
  <div class="hole" style="top:520px"></div>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/glm-5.3-range-test/shot-3-6_关我们什么事.html (reported line 319)May include surrounding context.

html
<div id="shake">
  <div id="cam">

    <!-- S0 设问 -->
    <div class="sc" id="s0">
      <div class="q1">这套「开源的<span class="shield-ico"></span>盾」</div>
      <div class="q2" id="q2">到底<em class="qmk">关我们什么事</em>？</div>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/examples/glm-5.3-range-test/shot-3-6_关我们什么事.html (reported line 319)May include surrounding context.

html
<div id="shake">
  <div id="cam">

    <!-- S0 设问 -->
    <div class="sc" id="s0">
      <div class="q1">这套「开源的<span class="shield-ico"></span>盾」</div>
      <div class="q2" id="q2">到底<em class="qmk">关我们什么事</em>?</div>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/template.html (reported line 4)May include surrounding context.

html
<!DOCTYPE html>
<html lang="zh-CN">
<head>
<!-- ============================================================
  ◆ 分镜演示页模板底盘（复制本文件后只改"画面层"与 cue）◆
  内置：虚拟时钟黑场播放器 / WebAudio 音效引擎 / 1920×1080 舞台
        镜头层 camTo·camFocus / 时间轴引擎(cue+补间+暂停) / HUD

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/template.html (reported line 4)May include surrounding context.

html
<!DOCTYPE html>
<html lang="zh-CN">
<head>
<!-- ============================================================
  ◆ 分镜演示页模板底盘(复制本文件后只改"画面层"与 cue)◆
  内置:虚拟时钟黑场播放器 / WebAudio 音效引擎 / 1920x1080 舞台
        镜头层 camTo·camFocus / 时间轴引擎(cue+补间+暂停) / HUD

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/batch-shot.js:45

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/cdp-shot.js:119

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/shot.js:87