ClawHub
Back to skill

Security audit

video-add-b-roll

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a disclosed B-roll video workflow that uses local/Pexels media and local ffmpeg processing with review gates before changing project outputs.

Install this only for projects where you are comfortable letting the agent process local video files, contact Pexels using a local API key, write review/cache artifacts, and update the project render state after explicit approvals. Keep the Pexels key in the local .env or environment as instructed, and review the generated pages and receipts before allowing final render/registration.

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"-an", "-sn", "-dn", "-map_metadata", "-1", "-write_tmcd", "0",
            *delivery_encoder_args(), str(part),
        ]
        subprocess.run(command, cwd=lut_path.parent if lut_path else None, check=True, capture_output=True)
        probe = _probe(part)
        _check_probe(probe, width, height, num, den, duration)
        subprocess.run(["ffmpeg", "-v", "error", "-i", str(part), "-map", "0:v:0", "-f", "null", "-"], check=True, capture_output=True)
Confidence
72% confidence
Finding
Although the ffmpeg invocation uses a safe argv list, it builds a complex filter string from partially data-driven values, including a LUT filename and selection-derived timing/filter parameters. Because ffmpeg filtergraphs are interpreted by ffmpeg itself, insufficient validation of values incorporated into -vf can create parser/option injection into the media-processing layer, potentially causing unintended file reads or unexpected processing behavior.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"-an", "-sn", "-dn", "-map_metadata", "-1", "-write_tmcd", "0",
            *delivery_encoder_args(), str(part),
        ]
        subprocess.run(
            command, cwd=lut_path.parent if lut_path else None,
            check=True, capture_output=True,
        )
Confidence
74% confidence
Finding
This ffmpeg command constructs a -filter_complex string using selection and segment metadata that ultimately originate from plan content. While there is no OS command injection, malformed or adversarial values embedded into ffmpeg's filter syntax can alter filtergraph semantics and cause unintended processing or access patterns inside ffmpeg.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
target.parent.mkdir(parents=True, exist_ok=True)
    part.unlink(missing_ok=True)
    try:
        subprocess.run([
            "ffmpeg", "-y", "-loglevel", "error", *inputs,
            "-filter_complex", ";".join(filters), "-map", output_label,
            "-t", f"{duration:.9f}", "-r", f"{num}/{den}",
Confidence
78% confidence
Finding
This ffmpeg invocation builds a complex filter graph using dynamic segment metadata and appends a LUT filename into the filter expression. Although the command is not executed through a shell, ffmpeg's filter language is its own parser, and insufficient escaping/strict validation of values incorporated into filter_complex or lut3d arguments can lead to argument/filter injection, unexpected file access within ffmpeg, or processing of unintended streams if upstream data becomes attacker-controlled.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
f"trim=start={shot_range[0]:.9f}:end={shot_range[1]:.9f},"
            f"setpts=PTS-STARTPTS,fps={num}/{den},scale={width}:{height}"
        )
        speaker_process = subprocess.Popen([
            "ffmpeg", "-v", "error", "-i", str(review_video),
            "-vf", speaker_filter, "-an", "-f", "rawvideo", "-pix_fmt", "rgb24", "-",
        ], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
Confidence
74% confidence
Finding
The ffmpeg '-vf' parameter is assembled from dynamic shot timing and geometry values into a filter string. Even without shell=True, ffmpeg parses this mini-language itself, so unsafe interpolation can permit malformed filtergraph injection or unintended behavior if upstream fields are attacker-influenced, leading to unauthorized media reads, corrupted output, or denial of service.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"ffmpeg", "-v", "error", "-i", str(review_video),
            "-vf", speaker_filter, "-an", "-f", "rawvideo", "-pix_fmt", "rgb24", "-",
        ], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        encoder = subprocess.Popen(
            _composite_encoder_command(
                width, height, num, den, part, encoder_args=encoder_args,
            ),
Confidence
72% confidence
Finding
The encoder command accepts externally supplied encoder_args and splices them directly into the ffmpeg argv list. While this is not shell injection, it still lets a caller alter ffmpeg behavior arbitrarily, which can redirect outputs, access additional files/protocols, overwrite unexpected locations, or weaken intended processing constraints if that parameter is user-influenced.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill exercises powerful capabilities including shell execution, file reads/writes, environment access, and network access, yet it declares no permissions or equivalent user-visible trust boundary. That gap can cause operators or calling systems to underestimate what the skill can do, increasing the chance of secret exposure, unintended file modification, or external data transfer during execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The description frames the skill as a narrow B-roll helper, but the body grants it authority to search remote services, download and import media, generate and publish review artifacts, mutate project state, render outputs, and finalize pipeline operations. This mismatch is dangerous because users may invoke it expecting limited editorial assistance while it actually performs broad side-effecting actions across the filesystem, network, and project workflow.

Unvalidated Output Injection

High
Category
Output Handling
Content
"-an", "-sn", "-dn", "-map_metadata", "-1", "-write_tmcd", "0",
            *delivery_encoder_args(), str(part),
        ]
        subprocess.run(command, cwd=lut_path.parent if lut_path else None, check=True, capture_output=True)
        probe = _probe(part)
        _check_probe(probe, width, height, num, den, duration)
        subprocess.run(["ffmpeg", "-v", "error", "-i", str(part), "-map", "0:v:0", "-f", "null", "-"], check=True, capture_output=True)
Confidence
83% confidence
Finding
The generated ffmpeg output is written to a derived path and the media-processing command incorporates dynamic filter content. In this skill context, the pipeline consumes plan and candidate metadata that may be attacker-influenced, so unsafe construction of ffmpeg filter arguments is more concerning than in a purely internal batch job because ffmpeg has a large attack surface and historically risky parser behavior.

Unvalidated Output Injection

High
Category
Output Handling
Content
"-an", "-sn", "-dn", "-map_metadata", "-1", "-write_tmcd", "0",
            *delivery_encoder_args(), str(part),
        ]
        subprocess.run(
            command, cwd=lut_path.parent if lut_path else None,
            check=True, capture_output=True,
        )
Confidence
84% confidence
Finding
This code assembles a filter_complex string from multiple selected segments and optional LUT input. Even without shell injection, attacker-controlled media metadata or plan values that reach ffmpeg's filter parser can manipulate processing semantics or exercise dangerous ffmpeg parsing behavior, making this a real output-handling risk in a media-normalization skill.

Static analysis

No suspicious patterns detected.