ClawHub
Back to skill

Security audit

电商爆款带货视频生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent AI Hive video-generation helper, with normal API and file behavior for that purpose plus some installation and API-key handling caveats.

Install this in a virtual environment, prefer pinned dependencies if available, and avoid typing a real API key directly into shell history. Use `AI_HIVE_API_KEY` or a protected config workflow, and only provide media files you intend to upload to AI Hive.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:165
Finding

Unpinned Runtime Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:165
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

bash
pip3 install requests

The installed package is subsequently imported by scripts/sales_video.py:12-15:

python
try:
    import requests
except ImportError:
    raise SystemExit("缺少 requests，请运行 pip3 install requests")

Technical Analysis

The installation instructions resolve the current version of requests and its transitive dependencies at installation time. The project does not provide a version constraint, lockfile, integrity hash, or isolated installation procedure.

Consequently, the dependency graph can change without any corresponding change to the audited project. If the package source or a newly published dependency release is compromised, following the documented installation command could install and execute code that was not included in this audit. Unpinned dependencies also create reproducibility and compatibility risks.

Attack Path

  1. An attacker compromises a package release or a transitive dependency available through the package index used by pip.
  2. The user follows the documented pip3 install requests command.
  3. pip resolves and installs the compromised or unexpectedly changed release.
  4. Malicious installation hooks may execute during installation, or malicious package code may execute when sales_video.py imports and uses the dependency.
  5. The injected code runs with the privileges of the user executing the installation or script.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the current user's privileges. Depending on those privileges, the compromised dependency could access the user's files, environment variables, AI Hive API key, uploaded media, generated outputs, and network resources.

Exploitation requires compromise or malicious modificat ...[truncated 138 chars]

Remediation
View remediation

Remediation Suggestions

  • Add an audited dependency manifest with exact versions, including transitive dependencies.

  • Generate and verify cryptographic hashes for every package artifact.

  • Install with a command such as:

    bash
    python3 -m pip install --require-hashes -r requirements.txt

  • Use a dedicated virtual environment rather than modifying the global Python environment.

  • Regularly review and update pinned versions through a controlled dependency-update process.

  • Configure pip to use an explicitly trusted package index and retain provenance information for installed artifacts.

T09 · Insecure Skill Coding Practices

Note
Location
SKILL.md:166
Finding

API Key Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:166; implemented by scripts/sales_video.py:477
Vulnerability Type: Sensitive credential passed through process arguments
Risk Level: Low

The documented authentication command places the complete secret directly in a command-line argument:

bash
python3 "$SKILL_PATH/scripts/sales_video.py" auth --api-key sk-api-你的密钥

The command-line interface requires that argument for the auth command:

python
save = commands.add_parser("auth", help="保存 AI Hive API Key")
save.add_argument("--api-key", required=True)
save.set_defaults(handler=auth)

Technical Analysis

Command-line arguments are not an appropriate transport for long-lived secrets. Depending on the operating system and local access controls, process arguments may be visible to other local users, process-monitoring agents, diagnostic tooling, audit logs, or automation systems. The command may also be retained in shell history.

The script securely applies mode 0600 to the saved configuration file, but this protection occurs only after the key has already been supplied through the command line. It therefore does not address exposure through process metadata or shell history.

Attack Path

  1. A user follows the documented authentication command and supplies a real AI Hive API key.
  2. The shell records the command in its history, or the operating system exposes the active process arguments to an authorized local observer or monitoring service.
  3. A local attacker, compromised process, log reader, or history reader retrieves the API key.
  4. The attacker sends authenticated requests to the AI Hive service using the stolen credential.
  5. The credential remains usable until it is revoked or expires.

Impact Assessment

An attacker obtaining the key could act with the API permissions assigned to that credential. This may include consuming generation quota, ...[truncated 308 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the required command-line secret with an interactive hidden prompt using getpass.getpass().
  • Alternatively, accept the key through standard input or a protected file descriptor.
  • Make the protected configuration-file or environment-variable workflow the primary documented method.
  • If environment variables are supported, warn users that they may still be exposed through debugging tools, inherited environments, or incorrectly configured logs.
  • Retain the existing 0600 permission enforcement for the stored configuration file.
  • Add explicit documentation warning users not to place real API keys directly in command history.
  • Recommend immediate key revocation and rotation if a key has already been exposed through history, logs, or process monitoring.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill invokes Python scripts that can read files, use environment variables for API keys, write outputs, and make network requests, but the manifest does not declare any tool scope or permission boundaries. This creates an avoidable trust gap: a reviewer or execution framework cannot tell from the skill metadata what capabilities are required, increasing the risk of over-privileged execution or unintended access to local files, secrets, or external services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction '固定使用 Seedance 2.5' is accompanied by a fully Chinese skill description and usage guidance, with no indication that users may choose their preferred language or locale for outputs. Under the stated policy, forcing a specific language/locale without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code file contains user-facing descriptions and error/help text exclusively in Chinese, beginning with the module docstring and continuing through command descriptions and runtime messages. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The API key placeholder contains Chinese-only instructional text ("请替换为你的APIKey"), which imposes a specific language in user-facing configuration content. The file does not offer an alternative language or document a justified locale-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.