ClawHub
Back to skill

Security audit

视频解说总入口

Security checks for vulnerabilities and agentic risk

Overview

ClawScan marks this skill suspicious because it reports an undeclared local dashboard with a path-confinement weakness and guidance that may send project details to external services; overall confidence is medium, and the scan is incomplete.

The verdict is suspicious, so review the dashboard and its access to project directories before installing. Consider whether you are comfortable with the described optional data being sent to external providers, and avoid using the skill with sensitive projects until the path-boundary issue and incomplete scan coverage have been addressed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (40)

Tainted flow: 'req' from os.environ.get (line 598, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/lib.py (reported line 599)May include surrounding context.

python
for attempt in range(max_retries):
        try:
            req = urllib.request.Request(endpoint, data=data, headers=headers)
            with urllib.request.urlopen(req, timeout=timeout) as resp:
                return json.loads(resp.read().decode("utf-8"))
        except urllib.error.HTTPError as e:
            body = _sanitize_api_error(e.read().decode("utf-8", errors="replace"))

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
87% confidence
Finding

The supplied chunk implements an interactive resource-browsing service rather than the declared video-generation pipeline. Although its libraries, projects, and runs relate to video recap work, this user-facing dashboard is a distinct capability not disclosed in the description, rather than merely an internal processing detail. The server is loopback-only and restricts requests to GET/HEAD; no external upload or video-generation behavior is visible. Path confinement and data-access details depend on imported modules that were not supplied.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
80% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/packaging_fonts.py (reported line 195)May include surrounding context.

python
("msyh", "Microsoft YaHei"),
        ("simhei", "SimHei"),
    ):
        if token in name:
            return family, path
    return None, path

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/recap_runtime.py (reported line 28)May include surrounding context.

python
print(f"[video-recap] ▶ {stage}/{script}", flush=True)
    # Stage scripts log Chinese; on Windows a piped stdout defaults to cp1252 and the
    # first log line would crash the child with UnicodeEncodeError.
    res = subprocess.run(cmd, env={**os.environ, "PYTHONIOENCODING": "utf-8"})
    if res.returncode != 0:
        raise SystemExit(f"{stage}/{script} 失败 (exit {res.returncode})")

Direct flow: pathlib.Path.read_bytes (file read) → pathlib.Path.write_bytes (file write)

High
Category
Data Flow
Confidence
80% confidence
Finding

Data flows directly from a source (env vars, files, network) to a sink (network output, exec, file write) without intermediate validation.

Content

Scanner excerpt · scripts/tts_audio.py (reported line 46)May include surrounding context.

python
if not samples:
        # A silent block has no RMS to normalize toward; copy it through with neutral
        # metadata rather than dividing by a zero sample count.
        output_wav.write_bytes(input_wav.read_bytes())
        return {
            "rms_dbfs_before": None,
            "rms_dbfs_after": None,

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The skill specifies Chinese narration without offering a language choice or requiring user opt-in.

Medium
Category
Output Handling
Confidence
90% confidence
Finding

L003 defines the output as a Chinese-narrated video, while activation also covers English requests such as “video recap” and “voiceover.” No language-selection step or justification for restricting narration to Chinese is provided, so the skill can impose a language the user did not request.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
- **视频理解（`understand.py`）**：将切分后的音频窗口发往 MiMo ASR（`mimo-v2.5-asr`），将抽帧 JPEG 连同 `background_research.json` 摘要发往 MiMo VLM（`mimo-v2.5`）。若工作目录已有完整分析产物，传 `--brief-only` 或 `--edited-storyboard-only` 则纯本地运行、不发起任何网络请求。
- **旁白配音（`voiceover.py`）**：按 `--tts-provider`（默认 `auto` 优先选已配置的 MiMo，其次 Fish Audio，绝不自动选 `index-tts`）将解说文本发往对应 TTS 服务：
  - `mimo-tts`：发往 MiMo TTS（`mimo-v2.5-tts`）；若显式传了 `--voice-ref <audio>`，还会将该参考音频切片发往 `mimo-v2.5-tts-voiceclone`（使用前请确认已获声音授权）。
  - `fish-audio`：需配置 `FISH_API_KEY`，将每段解说文本与 `FISH_TTS_REFERENCE_ID` 发往 `FISH_TTS_API_URL`（默认 `https://api.fish.audio/v1/tts`）。
  - `index-tts`：仅在显式指定 `--tts-provider index-tts` 时启用，将文本与 `INDEX_TTS_VOICE` 发往用户自建的 `INDEX_TTS_ENDPOINT`（详见 `references/index-tts.md`）。
- **解说校验（`validate.py`）、视频剪辑（`cut.py`、`shot_review.py`）与音画合成（`assemble.py`）**：纯本地确定性逻辑与 `ffmpeg` / `ffprobe` 调用，不发起任何网络请求。

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/config-playbook.md (reported line 24)May include surrounding context.

md
| Fish Audio key | `FISH_API_KEY` | — | required when Fish Audio is selected; never written to artifacts or cache metadata |
| Fish Audio model | `FISH_TTS_MODEL` | `s2.1-pro-free` | free model under Fair Use, no SLA; check Fish Audio's current policy |
| Fish Audio voice | `FISH_TTS_REFERENCE_ID` | `5653cea4ac83480aaf2bf45406556185`（娱乐扒妹） | optional override for the built-in narration voice; part of the per-segment cache settings |
| Fish Audio endpoint | `FISH_TTS_API_URL` | `https://api.fish.audio/v1/tts` | returns WAV directly to the existing voiceover pipeline |
| Self-hosted TTS | `INDEX_TTS_ENDPOINT` / `INDEX_TTS_VOICE` | — | explicit `--tts-provider index-tts` only; the endpoint is never written to disk, and segment `emotion`/style is rejected |
| TTS transport | `TTS_TIMEOUT` / `TTS_WORKERS` / `TTS_RETRIES` | `300` / `4` / `3` | request timeout, parallel segments, and per-segment retries for all providers |
| TTS hallucination bound | `TTS_MIN_SPEECH_RATE` | `2.5` | chars/s (e

The external-model task package includes project paths and detailed user content without a privacy warning.

Medium
Category
Output Handling
Confidence
97% confidence
Finding

The external-model handoff calls for project paths, detailed footage descriptions, subtitles, and existing project text without requiring redaction or destination-specific approval. Although optional and relevant to promotional editing, following this workflow can disclose confidential or unreleased user content and identifying local paths to an additional provider.

Content

No source excerpt is available for this finding.

The research workflow sends search terms derived from user context and filenames without a disclosure warning.

Medium
Category
Output Handling
Confidence
88% confidence
Finding

The workflow recommends external searches using terms extracted from user context and filenames without first distinguishing public information from confidential project details. Ordinary searches for released film titles are benign, but applying the same rule to unpublished titles, private names, or sensitive topics can disclose those details to search providers without informed approval.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/assemble.py (reported line 591)May include surrounding context.

python
seek_t = min(max(0.9, dur * 0.06), max(0.0, dur - 0.15))
    cover_path = Path(work_dir) / "cover.jpg"
    try:
        res = subprocess.run(
            [
                "ffmpeg", "-y", "-ss", f"{seek_t:.3f}", "-i", str(final_output),
                "-frames:v", "1", "-q:v", "2", str(cover_path),

Project library resolution bypasses the documented dashboard-root confinement.

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

The project-controlled library field is resolved without checking that the resulting directory remains under the dashboard root, allowing absolute paths, parent traversal, or symlinks to select an external library. That directory is scanned before rel_of reports it as outside the root, potentially exposing external library metadata through project binding results despite the dashboard's confinement boundary.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/detect.py (reported line 80)May include surrounding context.

python
"rawvideo",
        "-",
    ]
    result = subprocess.run(cmd, capture_output=True)
    if result.returncode != 0 or not result.stdout:
        raise RuntimeError(result.stderr.decode("utf-8", errors="replace")[:300])
    data = result.stdout

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/export_jianying.py (reported line 49)May include surrounding context.

python
duration is worse than a failed optional export. Still images legitimately
    report no duration (0).
    """
    result = subprocess.run(
        [
            "ffprobe",
            "-v",

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/final_qc.py (reported line 111)May include surrounding context.

python
"ffprobe", "-v", "error", "-print_format", "json",
        "-show_format", "-show_streams", str(path),
    ]
    res = subprocess.run(cmd, capture_output=True, text=True)
    if res.returncode != 0:
        raise RuntimeError((res.stderr or res.stdout or "ffprobe failed").strip())
    try:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/final_qc.py (reported line 131)May include surrounding context.

python
if shutil.which("ffmpeg") is None:
        return None, "ffmpeg unavailable"
    try:
        res = subprocess.run(
            ["ffmpeg", "-v", "error", "-xerror", "-sseof", "-2", "-i", str(path), "-f", "null", "-"],
            capture_output=True, text=True, timeout=60,
        )

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib.py (reported line 21)May include surrounding context.

python
# ── 配置 ──────────────────────────────────────────────────────────────

DEFAULT_MIMO_API_URL = "https://api.xiaomimimo.com/v1"
DEFAULT_MIMO_TOKEN_PLAN_CLUSTER = "cn"
MIMO_TOKEN_PLAN_API_URLS = {
    "cn": "https://token-plan-cn.xiaomimimo.com/v1",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib.py (reported line 31)May include surrounding context.

python
DEFAULT_MIMO_MODEL = "mimo-v2.5"          # VLM / chat (vision understanding)
DEFAULT_MIMO_ASR_MODEL = "mimo-v2.5-asr"  # speech-to-text
DEFAULT_MIMO_TTS_MODEL = "mimo-v2.5-tts"  # text-to-speech
DEFAULT_FISH_TTS_API_URL = "https://api.fish.audio/v1/tts"
DEFAULT_FISH_TTS_MODEL = "s2.1-pro-free"
DEFAULT_FISH_TTS_REFERENCE_ID = "5653cea4ac83480aaf2bf45406556185"
TTS_PROVIDERS = ("auto", "mimo-tts", "fish-audio", "index-tts")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/lib.py (reported line 141)May include surrounding context.

python
"""Filters the installed ffmpeg lists; empty when ffmpeg is absent."""
    ffmpeg = shutil.which("ffmpeg") or "ffmpeg"
    try:
        result = subprocess.run(
            [ffmpeg, "-hide_banner", "-filters"], text=True, capture_output=True, timeout=20
        )
    except FileNotFoundError:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/lib.py (reported line 403)May include surrounding context.

python
if len(display) > 2000:
            display = display[:1997] + "..."
    log(f"运行: {display}")
    return subprocess.run(cmd, capture_output=True, text=True, **kwargs)


_LEGACY_FILTER_FILE_OPTIONS = {

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/lib.py (reported line 421)May include surrounding context.

python
graph = os.path.join(tmp, "probe_filter.txt")
        with open(graph, "w", encoding="utf-8") as fh:
            fh.write("null")
        result = subprocess.run(
            ["ffmpeg", "-hide_banner", "-/filter_complex", graph],
            stdin=subprocess.DEVNULL,
            capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/loudness.py (reported line 63)May include surrounding context.

python
"""
    if shutil.which("ffmpeg") is None:
        return False
    result = subprocess.run(["ffmpeg", "-hide_banner", "-h", "filter=alimiter"],
                            stdin=subprocess.DEVNULL, capture_output=True, text=True,
                            encoding="utf-8", errors="replace", timeout=20)
    return "latency" in result.stdout

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/packaging_fonts.py (reported line 155)May include surrounding context.

python
"hand": "sans-serif:lang=zh-cn",
            "numeric": "sans-serif:weight=bold",
        }.get(role, "sans-serif:lang=zh-cn:weight=bold")
        res = subprocess.run(
            ["fc-match", "-f", "%{file}", query],
            capture_output=True, text=True, timeout=5, check=False,
        )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/recap_runtime.py (reported line 28)May include surrounding context.

python
print(f"[video-recap] ▶ {stage}/{script}", flush=True)
    # Stage scripts log Chinese; on Windows a piped stdout defaults to cp1252 and the
    # first log line would crash the child with UnicodeEncodeError.
    res = subprocess.run(cmd, env={**os.environ, "PYTHONIOENCODING": "utf-8"})
    if res.returncode != 0:
        raise SystemExit(f"{stage}/{script} 失败 (exit {res.returncode})")