Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this skill suspicious because scanners report an exposed, unauthenticated rendering endpoint that may overwrite files outside its output folder; analysis was also incomplete.
Consider avoiding installation until the renderer endpoint and file-write risk are reviewed and corrected, and the incomplete analysis is resolved. If you proceed, review the installer version and package provenance first.
scripts/smallest-star/render.tsUnauthenticated frame endpoint permits file overwrite outside the output directory
The attacker can create or truncate writable files outside the render directory when their parent directories already exist, corrupting documents, configuration, or project files. Written contents are PNG-encoded, not unrestricted executable payloads; code execution is not established.
Referenced artifact was not completely inspected
resume (`render.ts` skips frames that exist). Do not edit `src/` while it runs: a retry would pick up the
Referenced artifact was not completely inspected
- `scripts/smallest-star/render.ts`: Bun driver for headless Chrome; stills, ranges, modes, resume
Referenced artifact was not completely inspected
- `scripts/smallest-star/src/engine.js`: accumulate, denoise, bloom, tone map
Referenced artifact was not completely inspected
- `scripts/smallest-star/src/world.js`, `shots.js`, `vec.js`: layout, animation, helpers
The renderer needs local HTTP communication, but Bun.serve omits a hostname and therefore defaults to listening on all interfaces, exposing unauthenticated rendering endpoints to reachable hosts. The /frame endpoint joins an unchecked request-supplied filename to the output directory, permitting traversal-based PNG writes or overwrites outside that directory; other endpoints can terminate the render or consume substantial resources.
The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
The installation command executes an unpinned npm package, allowing its behavior to change between installations. Although this is a skill-installation CLI rather than an MCP server, a compromised or malicious future package release could execute code with the installing user's privileges.
The workflow instructs the agent to generate a voice clip for each caption and identifies ElevenLabs through varg as the example service. It does not warn that using this route transmits caption text, which may include private user-provided story content, to third-party services.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def measure(x):
tmp = os.path.join(HERE, '_tmp_mix.wav'); write(tmp, x)
out = subprocess.run(['ffmpeg', '-hide_banner', '-nostats', '-i', tmp, '-af', 'ebur128=peak=true', '-f', 'null', '-'], capture_output=True, text=True).stderr
os.remove(tmp)
I = float([l for l in out.split('\n') if l.strip().startswith('I:')][-1].split()[1])
P = float([l for l in out.split('\n') if l.strip().startswith('Peak:')][-1].split()[1])
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
here = os.path.dirname(os.path.abspath(__file__)); root = os.path.dirname(here)
tmp = sys.argv[1] if len(sys.argv) > 1 else '/tmp'
out_js = os.path.join(tmp, 'live.bundle.js')
subprocess.check_call(['bun', 'build', os.path.join(here, 'main.js'), '--minify', '--target=browser', '--format=iife', f'--outfile={out_js}'])
js = open(out_js).read().replace('</script', '<\\/script')
html = open(os.path.join(here, 'template.html')).read()
poster = os.path.join(here, 'poster.jpg')
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
'-i', a.audio, '-vf', vf, '-c:v', 'libx264', '-preset', 'slow', '-crf', a.crf, '-maxrate', '14M', '-bufsize', '28M', '-profile:v', 'high', '-pix_fmt', 'yuv420p',
'-colorspace', 'bt709', '-color_primaries', 'bt709', '-color_trc', 'bt709', '-movflags', '+faststart',
'-c:a', 'aac', '-b:a', '256k', '-shortest', a.out]
p = subprocess.Popen(cmd, stdin=subprocess.PIPE)
for i in range(a.total):
p.stdin.write(frame(i).tobytes())
if i % 120 == 0:
At L239–L240, the timeline identifies ElevenLabs narration via varg and explicitly states that narration is not code; L244 and L249 reference voice-over WAV assets. This contradicts the manifest's claim that everything in the film is code the agent writes and its stated suitability for a 'no assets' showcase. These entries do not, by themselves, establish that this file makes network requests.