ClawHub
Back to skill

Security audit

AI电商专家｜音频参考生成视频

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with IMIVA video generation, but its helper can call arbitrary IMIVA MCP tools and runs an unpinned npm package with the full local environment.

Install only if you are comfortable using IMIVA with local product/media files and an MCP token. Prefer running it in a clean shell with only MCP_TOKEN and API_URL set, review available tools before use, and treat paid task creation as requiring explicit confirmation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill instructs the agent to use shell commands, read local files, and access environment variables, but it does not declare permissions or constraints for those capabilities. This creates hidden execution and data-access scope, making it easier for the skill to read sensitive local material or use secrets like MCP tokens without transparent user consent.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose is narrowly framed around audio-reference video generation, but the referenced workflow includes listing all tools and calling arbitrary MCP tools through a generic wrapper. That effectively broadens the skill into a general IMIVA MCP client, which can enable actions outside user expectations and bypass least-privilege boundaries intended by the skill description.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def invoke(method: str, params: dict | None = None) -> dict:
    npx, token = require_runtime()
    env = os.environ.copy()
    env["MCP_TOKEN"] = token
    env["API_URL"] = os.environ.get("IMIVA_API_URL", os.environ.get("API_URL", DEFAULT_API_URL))
    proc = subprocess.Popen(
Confidence
78% confidence
Finding
Copying the full parent environment into a child process unnecessarily exposes all inherited secrets and runtime settings to an external npm package executed via npx. In this skill context, that is more dangerous because the child is a network-capable third-party package resolved at runtime, so any compromise of the package or its transitive dependencies could access unrelated credentials present in the environment.

Static analysis

No suspicious patterns detected.