Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill suspicious because its preview server may expose scene files to network clients, and it also flags privacy, installation, and incomplete-analysis concerns.
Consider the scene-file exposure and whether you are comfortable with the preview server’s network access. Before using features that send footage or other materials to model providers, check what will be shared and whether that sharing is approved. Review the install command and note that analysis was partial for two scripts; the suspicious verdict does not establish malicious intent.
scripts/stage_three.tsLocal preview exposes scene-directory files to network clients
A reachable client can download staging.json, revealing unpublished scene geometry, camera paths and shot timing, and can retrieve other known readable files located in the same directory. Directory listing or traversal outside that directory is not required for this finding.
Referenced artifact was not completely inspected
| `scripts/stage_three.ts`, `stage_three.html`, `cdp.ts` | three.js renderer (Bun, Chrome, ffmpeg) |
Referenced artifact was not completely inspected
| `scripts/stage_three.ts`, `stage_three.html`, `cdp.ts` | three.js renderer (Bun, Chrome, ffmpeg) |
Although this is an installation CLI rather than an MCP server, npx skills can download and execute an unpinned package version with the invoking user's privileges. A compromised future release could execute malicious code; this is a supply-chain exposure, not evidence that the current package is malicious.
Without declared permissions the skill's intent is opaque and cannot be validated.
The workflow recommends feeding reference footage directly to a video model without an explicit privacy checkpoint for third-party processing. Confidential footage or identifiable people could therefore be disclosed; approval of generation costs does not necessarily constitute approval of that disclosure.
The judging recipe directs users to supply briefs, references, and frames to multiple model families without checking whether those providers are authorized recipients. Removing author labels and randomizing filenames reduces judging bias but does not remove confidential content from the material.
Suspicious Unicode normalization or mixed-script content
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
a.add_argument("--start", type=float, default=None)
a.add_argument("--end", type=float, default=None)
a = a.parse_args()
probe = subprocess.run(["ffprobe", "-v", "error", "-select_streams", "v:0", "-show_entries", "stream=width,height",
"-of", "csv=p=0", a.reference], capture_output=True, text=True, check=True).stdout
w, h = probe.strip().split(",")[:2]
base = f"[0:v]format=rgb24,setsar=1[a];[1:v]scale={w}:{h},format=rgb24,setsar=1[b];"
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# yuv420p needs even dimensions
f = base + chain + ",scale=trunc(iw/2)*2:trunc(ih/2)*2,format=rgb24"
win = ([] if a.start is None else ["-ss", str(a.start)]) + ([] if a.end is None else ["-to", str(a.end)])
subprocess.run(["ffmpeg", "-v", "error", "-y", *win, "-i", a.reference, "-i", a.render, "-filter_complex", f + ",setpts=N/FRAME_RATE/TB" if a.video else f, *tail, "-shortest",
f"{a.out}_{name}.{ext}"], check=True)
print(f"{a.out}_{name}.{ext}")
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
vf = (f"{crop}scale={a.width}:-2,format=rgb24,"
f"drawgrid=w=iw*{a.step}:h=ih*{a.step}:t=1:c=white@0.55,"
"drawbox=x=iw/2-1:y=0:w=2:h=ih:c=red@0.8:t=fill,drawbox=x=0:y=ih/2-1:w=iw:h=2:c=red@0.8:t=fill")
subprocess.run(["ffmpeg", "-v", "error", "-y", "-i", a.image, "-vf", vf, "-frames:v", "1", a.out], check=True)
print(a.out, "grid: 0.1 steps, red = 0.5")
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if a.end:
cmd += ["-t", str(a.end - a.start)]
cmd += ["-an", "-vf", "scale=640:-2", str(clip)]
subprocess.run(cmd, check=True)
cap = cv2.VideoCapture(str(clip))
fps = cap.get(cv2.CAP_PROP_FPS) or 24
ok, prev = cap.read()
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(cmd):
return subprocess.run(cmd, capture_output=True, text=True)
def main():
The Bun server omits an explicit loopback hostname and serves requested files from the scene directory without authentication or a narrow asset allowlist. Network-reachable clients could retrieve confidential scene-directory files, while the printed localhost URL understates that exposure; live mode leaves the server running indefinitely.