ClawHub
Back to skill

Security audit

Multi-Platform Video Downloader

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real video-downloader skill, but its browser mode uses authenticated browser sessions and disables Chromium sandboxing while visiting remote pages, so it needs careful review before installation.

Install only if you are comfortable with a downloader that contacts video platforms, saves media and metadata locally, may use browser cookies, and runs browser automation. Prefer a disposable container or VM, pinned dependencies, no sensitive browser profile, minimal mounted folders, and avoid browser mode for untrusted URLs.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:46
Finding

Unpinned Third-Party Dependencies and Mutable Browser Component

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:46-49, SKILL.md:185, and SKILL.md:191
Vulnerability Type: Unpinned third-party dependencies and mutable executable components
Risk Level: Medium

Vulnerable Code

bash
# Required dependencies
pip install yt-dlp requests DrissionPage

# For DrissionPage browser automation
# Chrome browser will be auto-downloaded on first use

Additional installation instructions repeat the unpinned package installation:

bash
pip install yt-dlp
bash
pip install DrissionPage

Technical Analysis

The installation instructions retrieve the latest available versions of yt-dlp, requests, and DrissionPage without version constraints or cryptographic integrity hashes. Consequently, the exact code installed by users can change after the Skill has been reviewed.

Python packages may execute code during installation, import, or normal runtime. If a package release, package maintainer account, distribution infrastructure, or transitive dependency is compromised, following these instructions could introduce attacker-controlled code. The documented automatic Chrome download adds another mutable executable component whose version, source, and integrity verification procedure are not specified.

This is a supply-chain hardening weakness rather than evidence that any named dependency is currently malicious.

Attack Path

  1. An attacker compromises a dependency release channel, maintainer account, distribution endpoint, or transitive package.
  2. The attacker publishes a malicious or backdoored version under the legitimate package identity.
  3. A user follows the documented unpinned pip install instructions.
  4. Package resolution selects the attacker-controlled release because no reviewed version or hash is required.
  5. Malicious code executes during installation, import, or downloader operation with the privileges of the invoking user.

...[truncated 684 chars]

Remediation
View remediation

Remediation Suggestions

  1. Create a reviewed dependency lock file containing exact versions for all direct and transitive dependencies.
  2. Install packages with cryptographic hashes, for example through a hash-locked requirements file and pip install --require-hashes -r requirements.txt.
  3. Build and publish reproducible artifacts from a controlled CI environment rather than resolving current package releases on each installation.
  4. Pin the Chromium or Chrome version used by browser automation.
  5. Document the browser download origin and verify its publisher signature or cryptographic digest before execution.
  6. Run dependency vulnerability and provenance checks in CI, and update pins only after review and testing.
  7. Perform installation and execution as an unprivileged user in an isolated environment with minimal filesystem mounts and no unnecessary secrets.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/video_downloader.py:140
Finding

Chromium Sandbox Disabled While Processing Untrusted Web Pages

Content
View full analysis

Vulnerability Details

File Location: scripts/video_downloader.py:140-152 and scripts/video_downloader.py:262-274
Vulnerability Type: Unsafe browser security configuration
Risk Level: High

Vulnerable Code

The direct browser-download path disables the Chromium sandbox before visiting a user-supplied URL:

python
# 启动浏览器
co = ChromiumOptions()
co.set_argument('--no-sandbox')
co.set_argument('--disable-dev-shm-usage')
co.set_argument('--disable-gpu')

page = ChromiumPage(co)

# 访问页面
page.get(url)

The search path applies the same unsafe browser option:

python
co = ChromiumOptions()
co.set_argument('--no-sandbox')
co.set_argument('--disable-dev-shm-usage')
co.set_argument('--disable-gpu')

page = ChromiumPage(co)

search_url = f"https://www.douyin.com/search/{keyword}?type=video"
page.get(search_url)

Technical Analysis

Chromium normally uses operating-system sandboxing to restrict renderer and related subprocesses. The --no-sandbox argument explicitly disables this containment boundary.

The direct browser path opens url, which originates from a command-line argument and may identify an arbitrary website when browser mode is forced. Even a legitimate URL can redirect to attacker-controlled content. The page is allowed to execute remote JavaScript in a browser process whose normal sandbox has been disabled.

Disabling the sandbox is not itself a browser exploit. Exploitation also requires a vulnerability in Chromium, a browser component, or the automation stack. However, if such a vulnerability is triggered, the absence of sandboxing can make it easier to convert browser-renderer code execution into access under the browser process account.

Attack Path

  1. An attacker persuades a user or calling Agent to invoke the downloader with an attacker-controlled URL and the --browser option, or causes a trusted page to redirect to malicious content.
  2. The d ...[truncated 1192 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove co.set_argument('--no-sandbox') from both browser initialization paths.
  2. Run Chromium as a dedicated non-root operating-system user so its supported sandbox can initialize normally.
  3. If browser automation must run in a container, configure the container to support Chromium sandboxing rather than disabling it.
  4. Place browser automation in a dedicated, disposable container or virtual machine with no credentials or unrelated user data.
  5. Mount only the required download directory, preferably with carefully scoped permissions; do not mount sensitive host directories or the container runtime socket.
  6. Drop unnecessary Linux capabilities, enable no-new-privileges, use a restrictive seccomp/AppArmor/SELinux policy, and apply CPU, memory, process, and storage limits.
  7. Restrict outbound and internal-network access where practical to reduce post-exploitation reach.
  8. Validate URLs and consider an explicit scheme and hostname allowlist for browser mode. Revalidate redirect destinations before allowing navigation to sensitive or local network targets.
  9. Keep Chromium and DrissionPage patched and pin reviewed versions as part of the dependency-hardening process.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (16)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The entire user-facing documentation is written in Chinese, including headings, parameter explanations, and operational notes, with no indication that other languages are supported or that Chinese is required for a region-specific purpose. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill documentation describes capabilities that involve network access, shell execution, and file read/write via Python scripts and Docker, but it does not declare any explicit tool scope or permission boundaries. This increases the risk of over-broad agent execution, since a caller may invoke a skill with more capabilities than users expect and without clear sandboxing constraints.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description is broad enough to trigger on many ordinary 'download a video' requests, which can cause the agent to invoke a networked, file-writing, browser-automation workflow too eagerly. In this context, overbroad activation is risky because the skill can contact third-party platforms, save files locally, and potentially access browser-backed sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill notes that browser mode uses browser cookies for authenticated access but does not clearly warn that search/browser workflows may transmit authenticated session data and browsing context to third-party platforms. In a downloader skill that automates a real browser, this can expose user identity, account state, or privileged access unexpectedly, especially on sites like Douyin/TikTok where logged-in sessions materially affect requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill includes natural-language descriptions and CLI examples/comments in Chinese, such as the class docstring and several user-facing messages/examples, without indicating that the language is configurable or optional. This can violate language/locale policy when a skill implicitly assumes a specific language for users without opt-in.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The manifest describes a video downloader and keyword-based search tool, but the implementation depends on spawning the yt-dlp executable and instantiating a Chromium browser via DrissionPage. Network access and file writes are expected for downloading, but arbitrary subprocess execution and full browser automation are materially more powerful capabilities than the manifest text justifies.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_downloader.py (reported line 19)May include surrounding context.

python
def _check_yt_dlp(self):
        try:
            subprocess.run(['yt-dlp', '--version'], capture_output=True, check=True)
            return True
        except:
            return False

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_downloader.py (reported line 68)May include surrounding context.

python
try:
            # 获取视频信息
            cmd = ['yt-dlp', '--dump-json', '--no-download', '--quiet', url]
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
            
            if result.returncode != 0 or not result.stdout:
                print(f"    Cannot get video info, trying direct download...")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_downloader.py (reported line 95)May include surrounding context.

python
url
            ]
            
            download_result = subprocess.run(download_cmd, capture_output=True, timeout=180)
            
            if download_result.returncode == 0:
                downloaded_files = [f for f in os.listdir(self.save_path)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code automatically searches Douyin, opens pages in a browser session, fetches video content over the network, and writes multiple video and JSON files to disk. While there are progress prints, there is no user-facing warning that search mode will perform automated scraping-like activity and create batches of downloaded content and metadata.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.