ClawHub
Back to skill

Security audit

VideoClaw Pro

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its Feishu-based editing-script purpose, but it embeds Feishu app credentials and can create persistent Feishu documents without a clear confirmation gate.

Review before installing. Only use this with Feishu documents you are willing to share with the embedded robot app, rotate/remove the bundled Feishu secret before distribution, add explicit confirmation before any document creation, and treat retrieved rule documents as untrusted content rather than agent instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:52
Finding

Untrusted Feishu Documents Are Treated as Authoritative Agent Instructions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
videoclaw_lib.py:12
Finding

Hard-Coded Feishu Application Secret Exposes Tenant API Credentials

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
videoclaw_cli.py:33
Finding

Sensitive Document Content Is Passed Through Process Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This finding indicates the underlying implementation likely includes embedded Feishu credentials, direct SDK-based access, wiki resolution, and document write capabilities that are not transparently declared in the skill’s stated role. Hidden credentials and undeclared external-resource access materially increase the risk of unauthorized document access, secret exposure, and user deception about what the skill can do.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This finding indicates the underlying implementation likely includes embedded Feishu credentials, direct SDK-based access, wiki resolution, and document write capabilities that are not transparently declared in the skill’s stated role. Hidden credentials and undeclared external-resource access materially increase the risk of unauthorized document access, secret exposure, and user deception about what the skill can do.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The CLI exposes a write path that can create or modify Feishu documents even though the skill is described primarily as a document-reading assistant for generating editing scripts. In an agent context, unexpected write capability materially expands the action surface: a prompt, tool misuse, or indirect instruction could cause external state changes, data tampering, or unauthorized document creation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code contains hardcoded Feishu APP_ID and APP_SECRET directly in source. Embedded secrets are highly sensitive because anyone with code access can reuse them to obtain tenant access tokens, read accessible documents, and create or modify Feishu content within the app's granted scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill metadata emphasizes a constrained document-reading workflow, but the library also exposes a writer that creates and populates remote Feishu documents. This expands the capability from read-only processing to external state modification, which can lead to unanticipated data exfiltration, persistent output creation, or abuse of the bound Feishu tenant if invoked without clear user authorization.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill exposes exec and explicitly instructs running a local Python CLI that accesses external Feishu resources, but it declares no tool scope or permissions boundary. This creates an opaque capability surface where networked document access and local command execution are available without clear restriction, increasing the risk of overbroad data access or abuse.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: videoclaw-pro
model: kimi/kimi-k2.5
description: |
  视频剪辑脚本执行助手（增强版）- 根据飞书提示词库和直播素材文字档生成剪辑建议脚本。
  支持飞书文档（docx）和知识库（wiki）链接，自动解析权限问题。

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The workflow directs the agent to create and write a new Feishu document automatically, but there is no requirement to obtain explicit user confirmation immediately before modifying an external system. That can lead to unintended document creation, overwriting, or disclosure of generated content into shared workspaces.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The inline module documentation states the CLI supports Feishu document read/write functionality. This conflicts with the manifest's documented intent, which frames the CLI requirement specifically around document reading and script generation rather than mutation of remote Feishu content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The CLI performs external write operations without any warning, dry-run, or confirmation step. In an agent-driven environment, this makes accidental or prompt-induced writes much more likely, allowing unreviewed content to be pushed to Feishu and causing integrity or workflow disruption.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The module documentation states '增强版飞书文档读写', advertising both reading and writing capabilities. That conflicts with the manifest's explicit instruction that all document reading must go through a Python CLI script and its overall description as a script-generation assistant based on supplied documents, not a general Feishu read/write library.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module description and user-facing strings are written solely in Chinese, signaling a fixed language/locale experience without opt-in or explanation. The policy requires flagging language or locale constraints when the skill forces a specific language without giving the user a choice or documenting a justified regional scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The _get_access_token function performs an HTTP POST to Feishu and transmits app_id and app_secret, but its docstring only mentions token caching and does not warn that credentials are being sent to a remote service. Under the code-file criteria, network calls that transmit system or credential data should have some visible disclosure unless clearly warned elsewhere.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · videoclaw_lib.py (reported line 34)May include surrounding context.

python
if _cached_access_token and time.time() < _cached_token_expire:
        return _cached_access_token
    
    resp = requests.post(
        'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal',
        json={'app_id': APP_ID, 'app_secret': APP_SECRET}
    )

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · videoclaw_lib.py (reported line 34)May include surrounding context.

python
if _cached_access_token and time.time() < _cached_token_expire:
        return _cached_access_token
    
    resp = requests.post(
        'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal',
        json={'app_id': APP_ID, 'app_secret': APP_SECRET}
    )

Tainted flow: 'document_id' from requests.get (line 348, network input) → requests.get (network output)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · videoclaw_lib.py (reported line 237)May include surrounding context.

python
# 需要下载 docx 文件并解析
            access_token = _get_access_token()
            headers = {'Authorization': f'Bearer {access_token}'}
            resp = requests.get(
                f'https://open.feishu.cn/open-apis/drive/v1/files/{document_id}/download',
                headers=headers
            )

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

feishu_doc_writer creates a new Feishu document and uploads the provided content, which is a write operation affecting user data in an external system. Although there are execution logs, they do not clearly warn that user-provided content will be persisted remotely, and the docstring describes functionality without a safety disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module description and command help text are presented in Chinese, and the CLI does not offer any language selection or fallback. This creates a language policy concern because the skill imposes a specific locale on all users without an explicit opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The usage descriptions for core commands include Chinese-only text, and the script provides no mechanism for users to choose another language. This is a natural-language policy issue because the interface enforces one locale by default without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The error strings shown when required arguments are missing are written in Chinese, and there is no configurable locale behavior. This forces a language choice on users rather than offering one or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.