ClawHub
Back to skill

Security audit

Byted Byteplus Vod Video Enhancement

Security checks across malware telemetry and agentic risk

Overview

This appears to be a real BytePlus VOD upload and enhancement skill, but it needs review because credentialed API calls and media publication behavior are not tightly scoped enough.

Install only if you intend to upload selected media to BytePlus VOD using your own scoped credentials. Avoid setting VOD_HOST unless you have verified the official endpoint, treat returned playback or signed URLs as sensitive, and confirm your VOD space publication and access-control settings before processing private, regulated, or unreleased media.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'url' from os.environ.get (line 111, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
def post(self, action: str, version: str, body: dict) -> dict:
        body_str = json.dumps(body, ensure_ascii=False)
        url, headers = self._sign("POST", action, version, {}, body_str)
        r = requests.post(url, headers=headers, data=body_str.encode(), timeout=_HTTP_TIMEOUT)
        self._check(r)
        return r.json()
Confidence
93% confidence
Finding
The request URL is derived from the environment-controlled VOD_HOST and then used for authenticated outbound requests. Because the Authorization header is computed before the request is sent, an attacker who can influence environment variables or the loaded .env can redirect signed API traffic and credential-bearing headers to an arbitrary host, creating an SSRF-plus-credential-exfiltration condition.

Tainted flow: 'url' from os.environ.get (line 111, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
def get(self, action: str, version: str, params: dict) -> dict:
        url, headers = self._sign("GET", action, version, params or {}, "")
        r = requests.get(url, headers=headers, timeout=_HTTP_TIMEOUT)
        self._check(r)
        return r.json()
Confidence
93% confidence
Finding
This GET path has the same issue as the POST path: the target URL is constructed from an environment-controlled host and then used with signed authentication headers. If VOD_HOST is maliciously set, the client will send authenticated requests to an attacker-controlled endpoint, exposing request metadata and potentially enabling misuse of credentials or internal network access.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill documentation indicates the skill reads secrets from environment variables, accepts local file paths, and performs network uploads/polling, yet no explicit permissions are declared. This creates a permission-transparency gap: a host or reviewer may underestimate the skill's access to sensitive data and external connectivity, increasing the risk of unintended file access, secret exposure, or unreviewed data exfiltration paths.

Description-Behavior Mismatch

Medium
Confidence
79% confidence
Finding
The helper that fetches playback URLs also changes media state by publishing the asset first. In a skill whose stated purpose is upload/reference and enhancement, this hidden side effect can unintentionally expose content publicly or make it accessible sooner than the user expects, which is a security-relevant integrity and exposure issue.

Missing User Warnings

Medium
Confidence
76% confidence
Finding
Automatically publishing media without explicit confirmation or warning can violate user expectations and organizational release controls. In a media-upload skill, this makes accidental disclosure more likely because a benign request to obtain a play URL mutates publication state behind the scenes.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.