Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marked this skill suspicious because it found a reported stored cross-site scripting weakness and several supply-chain and external-sharing concerns, while parts of the analysis were incomplete.
Consider the suspicious verdict before installing. The scanners report unpinned package commands, external sharing without clear privacy warnings, and a stored XSS issue. Skillspector analysis was partial: 16 of 24 components were fully inspected, 8 were partially inspected, and static tool-misuse analysis was degraded, so the evidence is incomplete.
starter/serve.tsCross-origin edit poisoning leads to stored XSS
Attacker-supplied event-handler HTML executes when the affected shot is displayed. It can read project files exposed by the same-origin static server, transmit their contents to an attacker-controlled destination, and invoke the save/export endpoints to alter project state.
Referenced artifact was not completely inspected
- Render frame by frame (`capture.ts` or HyperFrames), never by screen recording.
L08 makes using the rendered MP4 as a Seedance reference on varg part of this skill's workflow, but does not warn that user-derived storyboard content will leave the local system. L21's unqualified 'runs locally' statement further obscures the external-processing step.
This is an unpinned npm CLI invocation, not an MCP server reference. On a fresh installation, npx can download and execute a mutable package release with the user's privileges, exposing the environment to a compromised future release.
Without declared permissions the skill's intent is opaque and cannot be validated.
The compatibility instructions recommend an unpinned npm CLI, rather than referencing an MCP server. A fresh npx invocation may execute a newly published HyperFrames release with local user privileges, creating a supply-chain exposure.
This executable rendering command leaves the HyperFrames package version unspecified. If npx resolves a compromised release, rendering can execute attacker-controlled code with access to the agent's local environment; the issue is npm supply-chain risk, not MCP configuration.
The instructions tell the agent to edit the rendered still using image models on varg, supplying the render as the first file. This transmits potentially private project imagery to external services, but the file does not warn that the image leaves the local environment.
The workflow explicitly instructs uploading local assets and submitting character sheets, location images, product references, and footage to varg/Seedance for processing. It does not warn that these assets leave the user's environment or advise checking whether identifiable people or confidential project material may be shared; the later cost approval addresses billing, not data disclosure.
The instructions enable unsafe SwiftShader without explaining that it opts into reduced security guarantees for software WebGL. Intended local rendering reduces exposure, but compromised scripts or untrusted scene content could reach this less-protected graphics path; the flag does not itself disable every Chrome sandbox.
The check command independently invokes an unpinned npm executable. A compromised release selected by npx could run arbitrary code before or during validation, despite the benign purpose of checking the render.
The lint command executes an npm CLI without selecting a reviewed version; it is not an MCP server reference. On a fresh environment, npx can fetch a mutable release whose compromise would allow code execution with the user's privileges.
The snapshot command can cause npx to retrieve and execute an unspecified package release. This creates a conditional supply-chain code-execution risk, rather than the MCP versioning issue stated by the detector.
The final render command runs HyperFrames without a fixed package version. A compromised release resolved by npx could execute with the agent's privileges and access local files or credentials.
The instructions direct the agent to image-edit rendered blockouts using models on varg, supplying the render as the first file along with a description of its contents. This transmits project imagery and scene details to an external service without warning users about the disclosure or checking whether the material is confidential.
Although three.js is pinned, the optional HyperFrames rendering command invokes an unpinned npm package. A fresh npx resolution could execute a compromised release with local user privileges; this is a supply-chain weakness, not an MCP server issue.
The comment recommends an unversioned npx hyperframes invocation, which can download and execute the current package release if no local installation resolves. This is a CLI rather than an MCP server, and the file does not execute the command itself, but following the recommendation introduces supply-chain risk into the otherwise legitimate rendering workflow.
The second unversioned HyperFrames invocation on this line has the same dependency-resolution risk: without a local installation, npx can fetch and execute an unreviewed release. Rendering is expected in this skill, making the command likely to be followed, but this is a repeated supply-chain issue rather than evidence of a malicious MCP server.
The generated completion message recommends running an unversioned package through npx, potentially executing a compromised release with the user's permissions. Logging this command is not itself execution, and HyperFrames is not an MCP server here, but presenting it as the next workflow step creates an actionable supply-chain exposure.
The second npx invocation in the completion message repeats the unpinned dependency risk for the render step. An existing pinned local installation could mitigate resolution risk, but none is established by this file, so following the printed instruction may execute an unreviewed package release.