ClawHub
Back to skill

Security audit

happynewyear

Security checks for vulnerabilities and agentic risk

Overview

The skill does generate New Year fortune videos, but it also sends personal details to external AI services and modifies the local environment in unsafe, under-disclosed ways.

Review carefully before installing. Use only in an isolated disposable environment, avoid entering real names, exact birth details, birthplace, or private wishes, and require the publisher to remove hardcoded credentials, restore TLS verification, stop runtime package and driver downloads, and add clear third-party data disclosure and consent controls.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/happynewyear.py:89
Finding

Hard-Coded API Credentials Exposed in Source Code

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/happynewyear.py:202
Finding

TLS Certificate and Hostname Verification Disabled

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/happynewyear.py:32
Finding

Automatic Installation of Unpinned Dependencies at Runtime

Content
View full analysis
Remediation
View remediation
--hash=sha256: ``` 4. Review and approve all direct and transitive dependencies. 5. Use an organization-controlled package repository with integrity monitoring. 6. Run the Skill in an isolated virtual environment or container as an unprivileged user. 7. Make optional rendering backends explicit configuration choices rather than silently installing them. 8. Fail with a clear dependency error when a required component is unavailable. ]]>

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/happynewyear.py:785
Finding

Runtime Browser-Driver Retrieval Followed by Local Execution

Content
View full analysis
Remediation
View remediation

other

Warning
Location
scripts/happynewyear.py:286
Finding

Undisclosed Transmission of Personal and Profile-Derived Data to External Services

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose presents the skill as a simple video generator, but the documented behavior includes dependency installation, outbound requests to multiple external services, hardcoded API credential use, remote asset fetching, and execution of subprocesses like pip, ffmpeg, and browser tooling. This mismatch is dangerous because it hides materially riskier behavior from reviewers and users, enabling secret exfiltration of personal input, supply-chain exposure, and execution of powerful binaries under the guise of a benign media task.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill automatically installs packages and invokes pip/browser/media tooling beyond what users would reasonably expect from a simple fortune-generation skill. This is dangerous because it allows remote code from package repositories and downloaded tooling to execute in the host environment, creating a strong supply-chain and environment-modification risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code globally disables TLS hostname and certificate verification for outbound HTTPS requests, making all API and asset downloads vulnerable to man-in-the-middle interception or tampering. Because this skill transmits personal user data and consumes remote model/image/audio responses, an active network attacker could steal secrets, alter content, or deliver malicious payloads.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This code sends detailed personal information provided by the user—such as name, gender, birth data, and wishes—to a remote LLM API without explicit disclosure or confirmation. In the context of a fortune-telling skill, this is especially sensitive because the data is intimate and unnecessary to transmit without informed consent and clear privacy boundaries.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill declares no explicit tool scope or permissions even though the documented dependencies and behavior imply filesystem access, network use, and process execution. In an agent environment, this creates a transparency and least-privilege failure: operators and users cannot accurately assess what the skill may do, increasing the chance of unauthorized data access, downloads, or command execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description is written as producing a specific Chinese New Year fortune video and does not indicate that users can choose output language or locale. This may violate language/locale policy if the skill implicitly forces Chinese output without opt-in or documented regional justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly collects personal information such as name, gender, birth date, personality, and wishes, yet the description provides no privacy notice, retention policy, minimization guidance, or warning that this data may be sent to external services. Because the skill also appears to use networked AI, image, and TTS services, users may unknowingly expose sensitive personal data to third parties.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The top-level documentation presents the script as a '纯净版' and says other logic remains unchanged, implying a limited presentation-layer adjustment. In reality, the script contains significant side-effecting behavior such as runtime package installation, remote API calls, browser automation, and ffmpeg/subprocess execution.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/happynewyear.py (reported line 42)May include surrounding context.

python
for lib in required_libs:
        try:
            import_name = lib.replace("-", "_")
            __import__(import_name)
        except ImportError:
            missing_libs.append(lib)

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/happynewyear.py (reported line 49)May include surrounding context.

python
for lib in required_libs:
        try:
            import_name = lib.replace("-", "_")
            __import__(import_name)
        except ImportError:
            missing_libs.append(lib)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
77% confidence
Finding

The generated HTML and overall user-facing interaction are explicitly fixed to Chinese, including the HTML lang attribute and multiple prompts/instructions, with no indication that the user can choose another language. This can violate language/locale policy where skills must not force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script auto-installs packages via pip during execution without a user-facing warning or approval step. This is dangerous because it changes the environment and executes third-party package code unexpectedly, which is a serious trust and supply-chain concern for end users.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

This line silently runs pip at execution time to install packages from a remote mirror, which expands the skill's capabilities and executes unreviewed third-party code in the current environment. In a skill that should generate a fortune video, automatic package installation is dangerous because it can introduce supply-chain compromise, persistence, and unexpected code execution without informed user consent.

Content

Scanner excerpt · scripts/happynewyear.py (reported line 62)May include surrounding context.

python
"--quiet",
                "--root-user-action=ignore"
            ]
            subprocess.check_call(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
            time.sleep(1)
        except subprocess.CalledProcessError:
            cmd = [

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

This fallback pip invocation performs the same unsafe behavior, but with visible output instead of quiet mode. It still executes package installation from a remote source during skill runtime, creating a supply-chain and arbitrary code execution risk unrelated to the user's stated task.

Content

Scanner excerpt · scripts/happynewyear.py (reported line 70)May include surrounding context.

python
*missing_libs,
                "-i", "https://pypi.tuna.tsinghua.edu.cn/simple"
            ]
            subprocess.check_call(cmd)

    if optional_missing:
        try:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
91% confidence
Finding

This line silently installs an optional rendering package at runtime, again executing code fetched from the network without user approval. Even though the package is optional, the behavior increases attack surface and can lead to supply-chain compromise in environments that merely attempt to use the skill.

Content

Scanner excerpt · scripts/happynewyear.py (reported line 78)May include surrounding context.

python
cmd = [sys.executable, "-m", "pip", "install", "imgkit",
                       "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",
                       "--quiet", "--root-user-action=ignore"]
                subprocess.check_call(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
            elif "selenium" in optional_missing and "webdriver-manager" in optional_missing:
                cmd = [sys.executable, "-m", "pip", "install", "selenium", "webdriver-manager",
                       "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
92% confidence
Finding

This installs Selenium and webdriver-manager at runtime, which significantly broadens execution and network capabilities by pulling browser automation components on demand. That is an unjustified expansion for a fortune-video skill and creates supply-chain, remote download, and browser-tooling abuse risks.

Content

Scanner excerpt · scripts/happynewyear.py (reported line 83)May include surrounding context.

python
cmd = [sys.executable, "-m", "pip", "install", "selenium", "webdriver-manager",
                       "-i", "https://pypi.tuna.tsinghua.edu.cn/simple",
                       "--quiet", "--root-user-action=ignore"]
                subprocess.check_call(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        except Exception:
            pass

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The generated fortune text is sent to an external TTS provider without explicit disclosure to the user. While less sensitive than raw birth details, it still exports user-derived personal content to a second third party and compounds privacy exposure.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/happynewyear.py (reported line 691)May include surrounding context.

python
mixed_out_path
    ]
    try:
        subprocess.check_call(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        return mixed_out_path
    except Exception:
        return None

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/happynewyear.py (reported line 868)May include surrounding context.

python
mixed_out_path
    ]
    try:
        subprocess.check_call(cmd, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
        return mixed_out_path
    except Exception:
        return None

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/happynewyear.py:94

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
scripts/happynewyear.py:204