ClawHub
Back to skill

Security audit

video-add-captions

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local video-captioning workflow that uses media tools and project file writes in ways that fit its stated purpose.

Install only if you are comfortable running local media tooling and npx/HyperFrames for the project you choose. Review the generated HTML pages and approval prompts carefully, and avoid pointing optional preview-generation output or review directories at unrelated important folders when using -Force.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
sample, spatial_context, project_root, source, source_s, source_hash,
            )
            source_frame = source_frames / f"source-{sample['file_stem']}.png"
            subprocess.run([
                "ffmpeg", "-hide_banner", "-loglevel", "error", "-y",
                "-ss", f"{background['seek_s']:.6f}", "-i", background["path"],
                "-frames:v", "1", str(source_frame),
Confidence
75% confidence
Finding
This code invokes ffmpeg on a user-influenced input path ('background["path"]' or source video) without constraining the protocol or argument semantics of that path. Because ffmpeg interprets inputs beyond plain local files, a crafted path from project data could trigger unintended network access, local file reads via special protocols, or processing of hostile media through a powerful external parser, increasing SSRF/LFI and decoder attack surface in an agent workflow.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
image.save(snapshots / f"frame-{index + 1:02d}.png")
        review = root / "review"
        review_script = Path(__file__).resolve().parent / "build_caption_review.py"
        review_result = subprocess.run([
            "python", str(review_script), "--source", str(source),
            "--timeline", str(timeline), "--plan", str(captions),
            "--snapshots", str(snapshots), "--out", str(review),
Confidence
82% confidence
Finding
This subprocess launches Python via the literal command name "python" instead of using sys.executable or a pinned interpreter path. In an agent or CI environment, PATH hijacking could cause execution of an attacker-controlled binary named python, resulting in arbitrary code execution under the test runner's privileges.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill instructs the agent to read and write numerous project files and execute many shell commands, yet it declares no permissions. That creates a trust-boundary problem: a host may expose the skill as low-risk while it can actually modify project state, invoke external tooling, open files, and trigger package downloads (`npx`), increasing the chance of unintended filesystem changes or command execution.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script's -Force path recursively deletes directories and files under user-influenced locations such as OutputDirectory and ReviewDirectory-derived paths without any safety prompt, explicit allowlist, or boundary check. If an operator supplies an unexpected or overly broad path, the script can destroy unrelated local data, and the video-processing context makes this more plausible because it routinely handles filesystem-heavy review and generated-artifact directories.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/check_caption_interaction.mjs:64

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/check_caption_review.py:39