ClawHub
Back to skill

Security audit

Media Download — videos from YouTube, TikTok, X, Instagram, Pinterest

Security checks for vulnerabilities and agentic risk

Overview

The downloading features fit the stated purpose, but an inaccurate promise about login cookies needs review before using authenticated downloads.

Review before enabling browser login: cookies can authenticate network requests, despite the local-only assurance. Approve the specific browser or cookie file and intended destination explicitly. Prefer preinstalled, reviewed downloader versions if you want to avoid automatic dependency downloads.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

Most shown options support the declared downloading purpose. However, the '-c chrome' example explicitly introduces access to the user's logged-in browser session, which is materially different from ordinary unauthenticated downloading and is not disclosed in the description. The 'no account' wording further obscures this capability, although it could mean an account is not required. The underlying video.sh implementation is not supplied, so the exact session-access mechanism cannot be verified.

Content

No source excerpt is available for this finding.

Code capability 'network' detected in scripts/pinterest.sh but not covered by declared permissions.

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
## When it fails

- **Login / "authentication required" / "Cannot parse data"** on Facebook, Instagram, Threads, Reddit, Vimeo or LinkedIn: these sites often block anonymous downloads. Ask the user which browser they are logged in with, then retry `video.sh` with `-c <browser>`. Do not read browser cookies without asking. yt-dlp reads them locally and they never leave the machine.
- **"Unsupported URL" or extractor errors**: sites change often, so update the tool and retry once. Use `brew upgrade yt-dlp gallery-dl`, `yt-dlp -U` for the standalone build, or `pip install -U yt-dlp gallery-dl`.
- **YouTube is low quality or warns about a JS runtime**: install ffmpeg (`brew install ffmpeg`). For the full YouTube format list also install `deno`.
- **Pinterest returns nothing**: the query is too narrow or Pinterest is rate-limiting. Retry with a broader query, a smaller `-n`, or `-k cookies.txt`.

The authenticated-download workflow incorrectly assures users that browser cookies never leave the machine, omitting disclosure of their use in network requests.

Medium
Category
Output Handling
Confidence
98% confidence
Finding

The statement that browser cookies 'never leave the machine' is misleading: authenticated downloads normally transmit applicable cookie values to the destination service in HTTP requests. Although asking permission reduces the risk, the inaccurate assurance undermines informed consent about using sensitive session credentials; the supplied documentation does not demonstrate malicious exfiltration.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'uvx gallery-dl'.

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

This invokes a command-line downloader, not an MCP server, but the underlying unpinned-dependency concern is valid: the uvx fallback can download and execute a gallery-dl release that has not been reviewed by the skill maintainer. A compromised or malicious release could execute with the invoking user's privileges and access local files, including a supplied cookies file; there is no evidence that such a compromise has occurred.

Content

No source excerpt is available for this finding.

Browser-cookie access is enabled without disclosing that it reads sensitive authentication data.

Medium
Category
Output Handling
Confidence
86% confidence
Finding

The cookie options are passed to yt-dlp, allowing it to read browser cookies or a supplied cookie file and use them for authenticated requests. The usage comment lists these options but does not explain their sensitive-data implications, and there is no confirmation or user-facing disclosure before access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.