ClawHub
Back to skill

Security audit

Byted Mediakit Video

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent MediaKit video-processing helper, but it sends media to cloud services for most operations and users should protect API keys and sensitive videos.

Before installing, verify that you trust the @volcengine/mediakit-cli package and pin or review the version where possible. Do not submit confidential, private, internal, or regulated media unless you are authorized to send it to MediaKit cloud services; prefer short-lived scoped URLs and local mode where supported. Use environment variables or a protected secret store for MEDIAKIT_API_KEY, avoid putting real keys directly in shell commands, and check any ~/.mediakit/config.json permissions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
reference/shared.md:62
Finding

API Key Exposure Through Command-Line Arguments and Plaintext Configuration

Content
View full analysis

Vulnerability Details

File Location: reference/shared.md, lines 62-65
Vulnerability Type: Sensitive credential exposure
Risk Level: Medium

bash
# Agent non-interactive initialization can explicitly write request source and runtime configuration:
mediakit-cli init --mode cloud-first --api-key <key> --runtime <runtime> --surface cli --yes
mediakit-cli init --mode local-first --api-key <key> --endpoint <url> --output-path ~/mediakit-output --runtime <runtime> --surface cli --credential-store config --yes

Technical Analysis

The documented initialization commands pass the MediaKit API key through the --api-key command-line argument. Secrets supplied as command-line arguments may be exposed through:

  • Shell history files
  • Process inspection utilities while the command is running
  • Agent execution traces and terminal session logs
  • Process accounting or endpoint-monitoring systems
  • Error reports that capture the complete command

The second example additionally selects --credential-store config. The documentation identifies the configuration file as ~/.mediakit/config.json, but it does not state that owner-only permissions are enforced or that credentials are encrypted at rest.

This is an insecure credential-handling pattern. The finding does not establish that the CLI itself logs or mishandles the key; the confirmed issue is that the Skill explicitly recommends placing the key in a command-line argument and potentially storing it in a configuration file without documenting storage protections.

Attack Path

  1. A user or Agent follows the documented non-interactive initialization procedure.
  2. The MediaKit API key is included in the process argument list and potentially recorded in shell history or execution logs.
  3. A local user, monitoring process, support-log recipient, or other actor with access to those records retrieves the key.
  4. The actor uses the recovered credential to authenticate t ...[truncated 814 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not pass API keys through command-line arguments.
  • Prefer a protected environment variable, an interactive secret prompt that disables terminal echo, or an operating-system credential manager.
  • If non-interactive initialization is required, accept the secret through standard input or a dedicated file descriptor rather than the process argument list.
  • Prevent secret values from appearing in command traces, debug logs, telemetry, and error messages.
  • If configuration-file storage remains supported, enforce owner-only permissions such as mode 0600 on Unix-like systems.
  • Prefer encryption backed by the operating system’s native credential store rather than plaintext JSON storage.
  • Document credential rotation and revocation procedures.
  • Update the example to use a placeholder environment reference without expanding the secret into a logged command.

T08 · Insecure Dependencies

Warning
Location
reference/shared.md:11
Finding

Unpinned Global Installation of an Executable npm Dependency

Content
View full analysis

Vulnerability Details

File Location: reference/shared.md, lines 11-16
Vulnerability Type: Unpinned executable supply-chain dependency
Risk Level: Medium

bash
# Install
npm install -g @volcengine/mediakit-cli

# Verify
mediakit-cli --version

Technical Analysis

The Skill directs users to install @volcengine/mediakit-cli globally without specifying an audited version or integrity value. Consequently, the package resolved during installation may differ from the version that existed when the Skill was reviewed.

An npm installation can execute package lifecycle scripts, and the installed CLI subsequently runs with the invoking user’s privileges. Global installation also increases the dependency’s reach because it places an executable into a shared command path rather than isolating it to the project.

No evidence establishes that the named package is currently malicious. The vulnerability is the unsafe, mutable dependency installation practice: a compromised publisher account, malicious future release, registry compromise, or unexpected upstream change could cause arbitrary code to execute outside the reviewed Skill contents.

Attack Path

  1. An attacker compromises the package publisher, registry distribution path, or a future package release.
  2. The attacker publishes a malicious version under the expected package name.
  3. A user follows the Skill documentation and runs the unpinned global installation command.
  4. npm resolves and installs the attacker-controlled version.
  5. Malicious lifecycle code may execute during installation, or malicious behavior may execute when mediakit-cli is invoked.
  6. The payload runs with the user’s privileges and may access files, environment variables, MediaKit credentials, and media supplied to the CLI.

Impact Assessment

A compromised dependency could execute arbitrary code with the privileges of the user running npm or the CLI. Potential impact includes:

  • Theft of MEDIAKIT_API_KEY ...[truncated 553 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a specifically reviewed version, for example @volcengine/mediakit-cli@<audited-version>.
  • Verify package provenance and integrity before installation.
  • Document the expected npm registry and prevent dependency resolution from untrusted registries.
  • Prefer a project-local installation with a lockfile over a global installation.
  • Use npm integrity controls, provenance attestations, and package-signing verification where available.
  • Audit package lifecycle scripts and transitive dependencies before approving upgrades.
  • Disable lifecycle scripts during installation when they are unnecessary and compatibility has been verified.
  • Establish an explicit update process in which new versions are reviewed before the pinned version is changed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (21)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger description is very broad ('when the user needs video-domain MediaKit CLI capabilities') and can match many generic video-related requests that do not clearly imply consent to invoke an external shell-backed tool. This increases the chance of over-triggering the skill, causing user media URLs or related data to be sent to external processing unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill enumerates operations that accept user-provided video/audio URLs and process them via an external CLI/service, but it does not prominently warn the user that their media references and content may be transmitted to external infrastructure. In a media-processing context, this can expose sensitive or private video, audio, OCR text, subtitles, or metadata without informed user awareness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file presents all user-facing instructions and parameter documentation exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The entire skill description and usage guidance are presented exclusively in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation states the command is cloud-only and that input URLs must be publicly accessible, but it does not clearly warn users that submitted media will be transmitted to a remote service for processing and may expose sensitive content. In a shell-enabled agent skill, this omission can cause unintended disclosure of private audio/video data or internal URLs because users may assume local processing or underestimate the privacy implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation explicitly describes a cloud-only command that requires a user-supplied video URL, but it does not warn that the referenced media will be transmitted to a remote service for processing. This can lead users to submit sensitive or private video content without informed consent, creating confidentiality and compliance risks, especially because video data may contain faces, locations, subtitles, or other personal information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation directs users to submit a remote video URL to a cloud-only processing service but does not warn that video content will be transmitted to an external provider and may contain sensitive or proprietary data. In a shell-enabled agent skill, this omission can cause users or downstream agents to send confidential media off-platform without informed consent, creating privacy, compliance, and data handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly states it is cloud-only and accepts a remote video URL, but it does not clearly warn users that using the operation sends video content to a remote service for processing. This is dangerous because users may submit sensitive or regulated video data without informed consent, creating privacy, confidentiality, or compliance exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation explicitly states the capability is cloud-only and accepts remote video URLs, but it does not warn users that submitted media and related metadata will be transmitted to an external service for processing. This can lead to accidental disclosure of sensitive or regulated video content because users may assume local processing or may not appreciate the privacy and compliance implications of uploading media to the cloud.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document states the capability is cloud-only, but it does not clearly warn users that provided video URLs and gameplay recordings will be transmitted to a remote service for processing. This can cause users to submit sensitive or proprietary gameplay footage without informed consent, creating privacy, confidentiality, and compliance risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation states that the input video URL must be publicly accessible, but it does not clearly warn users about the privacy and exposure implications of making media available on the public internet. In a video-processing skill, this can lead users to unintentionally expose sensitive or proprietary video content to third parties or broad network access during processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation states the capability is 'cloud only' and requires a public HTTP/HTTPS video URL, but it does not clearly warn users that the referenced media and associated metadata will be transmitted to and processed by a remote service. This can lead to unintended disclosure of sensitive video content, URLs containing tokens, or personal data, especially because the skill has shell permission and may be used in automated workflows where users assume local processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation states the capability is "cloud only" and requires a publicly accessible video URL, but it does not clearly warn users that video content and any embedded sensitive information will be transmitted to and processed by a remote service. In a video-processing skill, this increases the risk of accidental disclosure of confidential, regulated, or personal data because users may assume processing is local or may not appreciate the privacy implications.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

SQP-3 applies to all file types and includes language or locale policy violations. The document forces a single language presentation for all instructions and parameter descriptions, with no opt-in, alternative language, or stated region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

All user-facing instructional content in this file is presented in Chinese, and there is no indication that users can choose another language or that the locale restriction is intentional for a region-specific skill. This may violate a language/locale policy requiring user opt-in or explicit justification for a fixed language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The natural-language instructions and labels are presented only in Chinese, which can amount to a language policy issue when no user opt-in or locale limitation is documented. There is no indication that this skill is intended only for Chinese-speaking users or a China-specific deployment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language instructions and parameter descriptions are entirely Chinese, which can impose a language constraint on users without any stated opt-in or locale justification. Under the policy, forcing a specific language without user choice can be a language/locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The entire skill description and usage guidance are presented in Chinese, which can impose a language constraint on users. There is no indication that the skill offers language options or that the Chinese-only presentation is a documented, justified locale requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

All user-facing instructions and parameter explanations in this file are presented in Chinese, and the document does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-speaking context. This can violate a language/locale policy when a skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file presents all user-facing instructions in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This markdown file applies to SQP-2, and it documents cloud calls that automatically carry x-surface and x-runtime headers and require MEDIAKIT_API_KEY, but it does not warn users that host/runtime identifiers and request metadata will be sent to a remote service. Because the document is user-facing operational guidance, a brief disclosure about remote transmission of metadata would improve transparency.

Content

No source excerpt is available for this finding.