video-sound

• Outcome: Review
• Latest audit: Nov 13, 2026 · 8:35 PM UTC
• Version: 1.0.9

Overview

ClawScan marks this skill suspicious because scanners report risks in its downloaded-file handling and use of external services, while two files received only partial analysis.

Treat the suspicious verdict as a reason to review before installing. Consider whether you are comfortable with the reported file-write and network risks, possible transmission of scripts or audio to third-party services, and unpinned package downloads. The scan was partial, so it does not provide complete assurance about the artifact.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (40)

Tainted flow: 'req' from os.environ.get (line 61, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/audition.py (reported line 65)May include surrounding context.

python

headers={"Authorization": f"Bearer {key}", "Content-Type": "application/json",
                                          "User-Agent": "video-sound-audition/1"})
    try:
        with urllib.request.urlopen(req, timeout=120) as r:
            return json.loads(r.read().decode())
    except urllib.error.HTTPError as e:
        die(f"varg API {e.code} on {path}: {e.read().decode()[:300]}")

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

need librosa (run them with `uv run --with librosa`). scripts/audition.py renders through the varg API

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

python3 scripts/audition.py plan sound/lines_hard.md sound/voices.json -o sound/audition/audition.json --takes 2

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

python3 scripts/audition.py render sound/audition/audition.json # prints the price; --yes after approval

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

uv run --with librosa python3 scripts/audition.py score sound/audition/audition.json

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

python3 scripts/audition.py page sound/audition/audition.json -o sound/audition/audition.html

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

md

- `scripts/audition.py`: voice candidates, rendered, measured and put on one page to pick from

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

`references/evidence.md`):

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

md

- `references/evidence.md`: the tests and every sourced finding with its quote and link

Code capability 'env' detected in scripts/audition.py but not covered by declared permissions.

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

Code capability 'network' detected in scripts/audition.py but not covered by declared permissions.

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.

Content

No source excerpt is available for this finding.

The voice-generation and audio-judging workflow lacks a warning about sending user content to external AI services.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The README identifies external APIs but does not explicitly explain that scripts and audio may leave the user's environment for generation and judging. This creates a conditional confidentiality risk for private dialogue or unreleased material, rather than evidence of covert exfiltration.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

This is an unpinned package-execution command, not an MCP server reference. Running it can download and execute a changed or compromised release with the user's privileges; the remote skill installation also lacks an immutable revision.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The instruction invokes an unpinned npm CLI, not an MCP server. If no suitable local installation exists, npx can fetch and execute a mutable release, exposing the agent's files and credentials if that release is compromised.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md

An effect on every cut · the same sample machine-gunned · synth beeps for physical things · music with lyrics under
narration · music louder than words · a fade-out instead of a real ending · dead digital silence between lines ·
SSML `<break>` on Eleven v4/v3 · emotion adjectives instead of behaviour · naming an artist or song in a music prompt
· cloning a voice without consent · claiming you listened.

## Files in this skill

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/goal-prompt.md (reported line 70)May include surrounding context.

re-voice drifting lines, lip-sync with one clean voice.

Never: an effect on every cut, music louder than words, lyrics under narration, a fade-out ending, dead digital silence, cloning a voice without consent, claiming you listened.

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/voice.md (reported line 119)May include surrounding context.

md

clone someone else's voice." Instant clones require confirming "the right and consent to clone the voice".
- Gemini voice replication needs a 10-30 s clip plus a consent recording by the same adult speaker.
- Open weights forbid it too: Sesame CSM "Do not use this model to generate speech that mimics real individuals
  without their explicit consent"; Fish Drama 3's licence bans cloning a real person without consent.
- YouTube needs an AI label for realistic content that makes a person seem to say what they did not; cloning your
  own voice for voice-over or dubs needs none (https://support.google.com/youtube/answer/14328491).

The workflow instructs the agent to send dialogue to third-party speech services without a privacy disclosure.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The guidance recommends submitting dialogue and surrounding conversational context to external speech services without a privacy checkpoint. Although these services are relevant to the task, confidential scripts or personal information could be disclosed without informed approval.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx hyperframes'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/evidence.md (reported line 535)May include surrounding context.

md

/tts.md (stars 78,378)
- Carve the music bed against the voice by default (dip only the voice bands and follow the speech level) instead of a flat volume duck, which leaves voice and bed fighting at 1-3 kHz. — "**Carve by default — required whenever music plays under a voice.**" — HeyGen HyperFrames team (HeyGen HyperFrames 'hyperframes-audio' skill (retired 2026-10-21 into media-use/references/mixing.md); repo 78,378 stars, Apache-2.0). https://github.com/heygen-com/hyperframes/blob/e1925d4317/skills/hyperframes-audio/SKILL.md (stars 78,378)
- Do not level a voice whose loudness only falls 4-6 dB across sentences: that is normal declination, and flattening it sounds robotic; real unevenness is 12 dB or more. — "**A 4–6 dB spread across windows is normal speech**, not a defect — sentences decline as they end. Injected unevenness looks like 12 dB or more. Levelling a track that only has declination flattens the prosody and is heard as robotic." — HeyGen HyperFrames team (HeyGen HyperFra

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/evidence.md (reported line 557)May include surrounding context.

md

ed, not the listener; require a loudness-matched human blind test before calling it as good as real. — "The search optimises earshot's own models. Made sounds routinely out-score real recordings on them, which means the critic is satisfied, not that the sound is better." — Leonxlnx (earshot) (earshot by Leonxlnx, CPU-only 'ears for coding agents'; 3,766 GitHub stars, MIT, last push 2026-10-22; numbers marked [measured] come from 7 pro launch films). https://github.com/Leonxlnx/earshot/blob/main/skills/earshot/SKILL.md (stars 3,766)
- Cinetic's mix defaults: music ducks 10 dB under per-key typing (30 ms down, 250 ms back), 90% suck over the 0.2 s before a drop, mono below 120 Hz, gentle 2:1 bus compression above -14 dBFS. — "| Typing duck | music −10 dB under every run sounded per key, 30 ms down, 250 ms back (`mix.typing_duck_db`) | measured films carve a 10–16 dB dip for typing in the foreground |" — Leonxlnx (Cinetic) (Cinetic by Leonxlnx (same author as earshot), launch films from c

The casting workflow sends script text and potentially generated audio to external AI services without a privacy warning.

Medium

• Category: Output Handling
• Confidence: 91% confidence

Finding

This standalone prompt directs voice rendering and optional external audio judging without requiring disclosure of the content transfers. Price quotation and later listening approval do not establish approval to share confidential script text or audio with those providers.

Content

No source excerpt is available for this finding.

The workflow instructs sending audio takes to an external LLM judge without a privacy warning.

Medium

• Category: Output Handling
• Confidence: 95% confidence

Finding

The workflow explicitly instructs sending audio takes to a judge and discusses external analysis services without a privacy approval step. Audio can contain confidential dialogue and identifiable voices, and human selection after judging does not prevent the earlier disclosure.

Content

No source excerpt is available for this finding.