ClawHub
Back to skill

Security audit

Video Transcript Method

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly about video transcription, but it includes an unsafe TLS certificate-bypass in its instructions and helper script that users should review before installing.

Review this skill before installing. Its video transcription workflow is understandable, but do not run the bundled transcribe.py as-is on networks or machines you care about until the SSL certificate bypass is removed. Use explicit output paths, avoid private or credential-gated videos unless you understand the toolchain, and check copyright permissions for downloaded media.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/transcribe.py:18
Finding

Global TLS Certificate Verification Disabled

Content
View full analysis

Vulnerability Details

File Location: scripts/transcribe.py:18-27
Additional Location: SKILL.md:31-35
Vulnerability Type: Improper certificate validation
Risk Level: Medium

Vulnerable Code

python
import argparse
import ssl
import sys

# Bypass SSL certificate verification issues common on macOS
ssl._create_default_https_context = ssl._create_unverified_context

import whisper

The insecure behavior is also explicitly recommended by the Skill documentation:

markdown
1. **Download audio track**: `yt-dlp -f "bestaudio" --extract-audio --audio-format mp3`
   - Audio tracks are generally unaffected by video quality or membership restrictions
   - For SSL certificate issues: set `ssl._create_default_https_context = ssl._create_unverified_context`

Technical Analysis

The script replaces Python's default HTTPS context with an unverified context at process scope. Consequently, HTTPS clients that rely on the default context may no longer validate the remote server's certificate chain or hostname.

This override occurs before the whisper package is imported and remains active throughout the process. Network operations initiated while loading a Whisper model, or by other imported components using the default SSL context, may therefore accept an untrusted or forged certificate.

The issue compromises transport authentication. Encryption alone does not establish that the client is communicating with the intended server when certificate verification is disabled. Any independent artifact-integrity verification performed by a dependency may reduce the risk of modified model files, but it does not correct the missing server authentication and must not be assumed without verification.

Attack Path

  1. A user runs scripts/transcribe.py in an environment where the requested Whisper model is not already available locally.
  2. ssl._create_default_https_context is globally r ...[truncated 1636 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the process-wide certificate verification override:

    python
    # Delete this assignment:
ssl._create_default_https_context = ssl._create_unverified_context

  2. Allow Python and all dependencies to use the verified default TLS context:

    python
    ssl.create_default_context()

  3. Correct local certificate-store problems rather than bypassing validation:

    • Install or update the operating system's trusted CA certificates.
    • Update Python's certifi package where applicable.
    • Configure a trusted organizational CA bundle for environments using an authorized TLS inspection proxy.
    • Use SSL_CERT_FILE or dependency-supported CA configuration to reference the validated bundle.

  4. Fail securely when certificate validation fails. Report an actionable error and stop the download instead of retrying without verification.

  5. Verify remotely downloaded model artifacts using a trusted cryptographic digest or signed manifest. Artifact verification should supplement TLS validation, not replace it.

  6. Remove the insecure SSL-bypass recommendation from SKILL.md. Replace it with guidance for repairing the trust store or supplying a narrowly scoped trusted CA bundle.

  7. If exceptional development diagnostics require an insecure mode, keep it disabled by default, display a prominent warning, prohibit its use with sensitive data, and scope it to a single request rather than changing the global HTTPS context.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description promises a comprehensive, platform-agnostic pipeline for converting any online video into a structured transcript with timestamps, metadata, and summaries. The supplied code does something much narrower: it accepts a local audio file path, loads a Whisper model, transcribes in Chinese, and writes each segment to a text file with a simple [MM:SS] timestamp. There is no code for handling video URLs, downloading content, extracting audio from video, checking existing subtitles/CC, collecting metadata, summarizing content, or emitting a richer structured format. The primary purpose is therefore materially narrower than declared, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill instructs the agent to write output files (.txt/.md) and references saving artifacts, but it does not declare any tool scope or permissions. Undeclared file-write capability weakens least-privilege controls and can cause agents or runtimes to grant broader filesystem access than users expect, especially when handling attacker-supplied URLs, titles, or transcript content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

Disabling SSL certificate verification globally makes any HTTPS connection in this process trust unverified endpoints, enabling man-in-the-middle attacks during model download or other network access. In this skill's context, that is especially dangerous because a tampered model artifact or dependency payload could corrupt results or potentially introduce malicious content into the local environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code hard-codes language="zh", which enforces a specific language/locale behavior for all inputs. The file does not present this as an opt-in choice or clearly justify the restriction as a region-specific tool, so it conflicts with the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

技能清单描述该方法可处理“任何在线视频”，覆盖从URL解析到结构化文字稿输出的全流程；但此文件的CLI仅接受本地音频输入路径和输出路径，并调用Whisper对音频做转录。代码没有任何视频URL处理、下载、字幕检测、元信息提取、语义分段或摘要逻辑，因此与技能描述存在明显能力落差。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

文件头文档和参数说明称其为“Bilibili视频音频转录脚本”，容易让使用者认为该脚本可直接处理B站视频。实际上实现只接受本地音频文件路径并调用Whisper转录，没有任何视频下载、音频提取或平台相关处理，文档表述与代码行为不符。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

transcribe_audio 的文档描述较宽泛，结合技能清单会让人预期输出为更完整的结构化文字稿。实际写出的只是逐行时间戳加文本内容，没有元信息、摘要或结构化字段，文档表达与实际输出能力存在偏差。

Content

No source excerpt is available for this finding.