edit-footage-with-code

• Outcome: Review
• Latest audit: Nov 13, 2026 · 7:33 PM UTC
• Version: 1.0.7

Overview

ClawScan marks this video-editing skill suspicious because scanners report a command-injection weakness and repeated use of unpinned tools that could run changed packages; the evidence is incomplete because reference resolution was partial.

Treat this as a review warning, not a finding of malicious intent. Before installing, consider whether you trust the skill's shell-command handling and unpinned package sources, and whether its workflow may send footage or audio to external services. Scanning was partial: all listed components were scanned, but some references could not be resolved, so the evidence does not cover those references.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (48)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/build_cut.py (reported line 60)May include surrounding context.

python

oject name="Rough cut">
        <sequence format="r1" duration="%s" tcStart="0s" tcFormat="NDF" audioLayout="stereo" audioRate="48k">
          <spine>
%s
          </spine>
        </sequence>
      </project>
    </event>
  </library>
</fcpxml>
""" % (rt(1), w, h, quoteattr(os.path.basename(take)), rt(total), quoteattr(uri), rt(edl["frames"]), rows)


def main():
    p = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
    p.add_argument("edl"); p.add_argument("--take", required=True)
    p.add_argument("--fade-ms", type=float, default=30, help="audio fade at each join. Use 8 if you moved an in point within 30 ms of a word")
    p.add_argument("--crf", type=int, default=18); p.add_argument("--src", help="path as the composition sees it")
    a = p.parse_args()
    edl = json.load(open(a.edl)); fps = edl["fps"]; segs = edl["segments"]; d = os.path.dirname(a.edl) or "."
    # edit only "in" and "out" by hand: frames and positions are al

eval() call detected

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

Direct eval() call evaluates arbitrary expressions. This can be exploited to execute malicious code or exfiltrate data.

Content

Scanner excerpt · scripts/judge_pack.py (reported line 107)May include surrounding context.

python

def sheets(video, dur, joins, d):
    run("ffmpeg", "-y", "-v", "error", "-i", video, "-vf", "fps=%f,scale=320:-2,tile=6x4" % (24 / max(dur, 1)), "-frames:v", "1", os.path.join(d, "sheet.jpg"))
    # the frames either side of each jump: at most 18, spread across the whole film so the sheet stays readable
    fps = float(eval(run("ffprobe", "-v", "error", "-select_streams", "v:0", "-show_entries", "stream=r_frame_rate", "-of", "csv=p=0", video).stdout.strip()))
    picks = joins if len(joins) <= 18 else [joins[round(i * (len(joins) - 1) / 17)] for i in range(18)]
    json.dump({"joins_shown_at_s": picks, "tiles_per_join": "2 or 3"}, open(os.path.join(d, "joins_index.json"), "w"))
    if picks:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This is the same shell-injection sink identified by the AST4 finding: a.model enters executable shell text without escaping. An agent that accepts a model identifier from lower-trust task content can inadvertently grant that content command-execution capability, despite quoting paths and language.

Content

Scanner excerpt · scripts/transcribe_islands.py (reported line 39)May include surrounding context.

python

True)
        wav = os.path.join(d, "island.wav")
        # a little room either side so the first and last consonants survive
        s0, e0 = max(0, s - 0.08), e + 0.12
        subprocess.run(["ffmpeg", "-y", "-v", "error", "-ss", "%.3f" % s0, "-to", "%.3f" % e0, "-i", a.take, "-vn", "-ac", "1", "-ar", "16000", wav], check=True)
        cmd = a.cmd.format(wav=shlex.quote(wav), dir=shlex.quote(d), model=a.model)
        if a.language:
            cmd += " --language " + shlex.quote(a.language)
        r = subprocess.run(cmd, shell=True, capture_output=True, text=True)
        path = os.path.join(d, "transcript.json")
        if r.returncode or not os.path.exists(path):
            print("island %d (%.2f-%.2f s) failed: %s" % (i, s, e, r.stderr.strip()[-200:]), file=sys.stderr)
            continue
        for w in json.load(open(path)):
            words.append({"text": w["text"], "start": round(min(e0, s0 + float(w["start"])), 3), "end": round(min(e0, s0 + float(w["end"])), 3), "island": i})
    json.dump(w

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This is an npm CLI invocation, not an MCP server, but the underlying supply-chain concern is valid: npx can download and execute an unspecified version of skills. A compromised release could execute with the user's permissions, and the installation also retrieves skill content from an unpinned repository.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The workflow invokes an unversioned npm executable without first establishing a pinned local installation. Although this is not an MCP server, npx may fetch a changed or compromised release and execute it with access to private source footage and other user files.

Content

No source excerpt is available for this finding.

The transcription workflow selects an English-only model without asking for the footage's language or offering a language choice.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

The transcription command explicitly selects small.en, an English-only Whisper model; the cut-verification command repeats this selection at L108. The skill does not limit its scope to English footage or obtain language opt-in, so these defaults impose English transcription on potentially non-English speech.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The second transcription command again relies on an npm executable whose version is not established by the workflow. If npx resolves it remotely, a compromised release can run with user privileges; processing an edited copy rather than the source does not limit those privileges.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The fallback installs skills through an unpinned npm CLI, not an MCP server. If no suitable local installation exists, npx can download and execute a changed or compromised package with the agent's permissions; the editing task does not require trusting arbitrary future releases.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Project initialization invokes an unpinned npm executable that may be fetched automatically. A compromised release could execute code with access to the agent's files and credentials; legitimate project creation does not remove this supply-chain exposure.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The transcription command uses an unpinned CLI that npx may download and execute. If the resolved release is compromised, it gains code execution and access to the footage being transcribed, despite the apparent use of a local transcription model.

Content

No source excerpt is available for this finding.

The recommended HeyGen transcription option lacks a warning that footage audio is sent to a third-party service.

Medium

• Category: Output Handling
• Confidence: 91% confidence

Finding

The skill offers the hosted HeyGen transcription engine while warning only about billing, not the transfer of audio to a third party. If an agent selects it without informed authorization, private conversations or unreleased footage could leave the user's environment; the local alternatives make this disclosure avoidable.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Caption catalog discovery runs an unpinned npm CLI rather than merely reading static data. A compromised release selected by npx could execute with agent permissions, even though the requested operation appears read-only.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The block-add command invokes an unpinned npm CLI that may be downloaded at execution time. A compromised release could execute arbitrary code and modify the project; the clipboard warning does not address this supply-chain risk.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The registry catalog command can resolve and execute an unpinned npm package. Compromise of a subsequently resolved release could expose local project data and credentials; catalog browsing does not need that unrestricted trust.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Media treatment is delegated to an unpinned npm executable. If npx retrieves a compromised release, it can execute with the agent's permissions and access source footage, making this a conditional supply-chain vulnerability rather than evidence of malicious intent.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The validation command runs an unpinned npm CLI, which npx may obtain from the registry. Calling the operation a check does not sandbox it: a compromised release can execute arbitrary code before returning validation results.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Snapshot generation invokes an unpinned npm executable with access to the editing project. A compromised release fetched by npx could execute arbitrary code or access private footage; generating stills does not limit the executable's actual permissions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Audio inspection uses an unpinned npm CLI that may be downloaded automatically. A compromised resolved version could execute with agent permissions and access recorded speech, regardless of the command's diagnostic purpose.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Rendering runs an unpinned npm CLI rather than a reproducibly installed executable. If npx resolves a compromised release, the renderer can execute arbitrary code with access to the project's media and the agent's environment.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

History inspection invokes an unpinned npm executable that may be fetched automatically. Although the requested action is read-only, a compromised release would still execute with the agent's privileges; this is a CLI supply-chain concern, not an MCP-specific issue.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The supplied transcription template invokes unversioned HyperFrames through npx without establishing a pinned local dependency. This is not an MCP reference, but it can cause remote package execution with access to the comparison footage and local files if a package must be fetched.

Content

No source excerpt is available for this finding.

The judging workflow lacks a privacy warning about sharing footage-derived content with model providers.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The protocol directs agents to give model judges footage-derived transcripts and frames without an explicit confidentiality or provider-approval gate. Randomizing IDs and removing metadata reduces judging bias but does not anonymize spoken content or faces, so use of a hosted judge could disclose private or unreleased material.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The recommended command can execute an unversioned skills package and install instructions from a mutable repository revision. The advice to read repositories is useful, but it does not ensure that the installed content matches what was reviewed; this is a supply-chain exposure rather than an MCP configuration issue.

Content

No source excerpt is available for this finding.

The captioning prompt requires web searches for names from the video without warning about external disclosure.

Medium

• Category: Output Handling
• Confidence: 96% confidence

Finding

The prompt explicitly requires web searches for every name extracted from the video without checking whether those names are confidential. Search queries disclose information to external providers and can expose private identities, client relationships, or unreleased project details even though the editing task itself could remain local.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command does not pin either the skills CLI or the retrieved skill revision. Although no MCP server is involved, a compromised npm release can execute locally, and changed skill instructions can influence the editing agent.

Content

No source excerpt is available for this finding.