ClawHub
Back to skill

Security audit

Video Transcriber

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent video transcription purpose, but its documented workflow uses unsafe download command patterns for user-supplied video URLs.

Review before installing. The skill appears intended for legitimate video transcription, not theft or persistence, but it should be tightened before routine use: remove --no-check-certificate, validate and allowlist supported video URLs, avoid shell string interpolation, use isolated temporary output directories, and make downloads/local file retention clear to the user.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:31
Finding

TLS Certificate Verification Disabled for Media Retrieval

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–34
Vulnerability Type: Disabled TLS certificate validation
Risk Level: Medium

bash
# 1. 获取视频时长
yt-dlp --dump-json --no-check-certificate "URL" | jq -r '.duration, .title'

# 2. 下载音频
yt-dlp -f bestaudio --no-check-certificate "URL" -o audio.m4a

Technical Analysis

Both documented yt-dlp commands use --no-check-certificate, which disables validation of the remote server's TLS certificate. This prevents yt-dlp from reliably authenticating the endpoint from which metadata and media are retrieved.

An attacker able to intercept or redirect network traffic could impersonate the intended endpoint and provide modified metadata or media. The risk applies both to the initial metadata query and to the subsequent audio download.

Attack Path

  1. A user asks the Agent to transcribe a supported video.
  2. The Agent invokes the documented yt-dlp command with --no-check-certificate.
  3. An attacker with control over DNS resolution, a network gateway, or another relevant traffic-interception position redirects the connection.
  4. Because certificate validation is disabled, the Agent accepts the attacker's endpoint without detecting the certificate mismatch.
  5. Attacker-controlled metadata or media is written to the working environment and processed by downstream tools.

Impact Assessment

A successful attacker can substitute the media and metadata processed by the workflow, compromising transcription integrity and potentially exposing downstream media parsers to maliciously crafted input. This does not directly grant elevated privileges; any additional effect would occur within the permissions of the Agent and the invoked media-processing tools.

Remediation
View remediation

Remediation Suggestions

  • Remove --no-check-certificate from every yt-dlp invocation.
  • Keep operating-system and runtime CA certificate stores current.
  • Diagnose certificate failures rather than bypassing verification.
  • Restrict accepted URLs to HTTPS endpoints on explicitly approved Bilibili and YouTube domains.
  • Fail closed when TLS authentication or hostname validation fails.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:24
Finding

Unsafe Shell Command Construction Pattern for User-Supplied URLs

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–34
Vulnerability Type: Potential shell command injection through textual URL substitution
Risk Level: High

bash
# B站视频字幕
python3 ~/.openclaw/extensions/bilibili-youtube-watcher/scripts/get_transcript.py "URL" --lang zh-CN

# YouTube字幕（尝试en/zh-CN）
python3 ~/.openclaw/extensions/bilibili-youtube-watcher/scripts/get_transcript.py "URL" --lang en
bash
# 1. 获取视频时长
yt-dlp --dump-json --no-check-certificate "URL" | jq -r '.duration, .title'

# 2. 下载音频
yt-dlp -f bestaudio --no-check-certificate "URL" -o audio.m4a

Technical Analysis

The workflow represents a user-controlled URL as a textual placeholder embedded in shell command examples. It does not instruct the Agent to use argument-array execution, validate the URL, or avoid direct string substitution.

Double quotes do not make arbitrary text safe when the command itself is assembled by replacing the placeholder before shell parsing. For example, shell command substitution syntax embedded in a crafted value can be interpreted when the completed command is parsed. This issue is exploitable if the Agent performs direct textual interpolation into these command templates. By contrast, passing the URL as a properly separated process argument without a shell would prevent shell metacharacters from being interpreted.

Attack Path

  1. An attacker submits a purported Bilibili or YouTube URL containing shell syntax, such as command substitution.
  2. The Agent directly replaces the documented URL placeholder with the untrusted string.
  3. The Agent executes the resulting command through a shell.
  4. The shell evaluates the injected syntax while parsing the assembled command.
  5. The injected command executes with the same operating-system identity and permissions as the Agent.

Impact Assessment

Successful exploitation can provide arbitrary command execution under the Agent's l ...[truncated 336 chars]

Remediation
View remediation

Remediation Suggestions

  • Never construct shell command strings by directly replacing URL with user-controlled text.
  • Invoke each program through an argument-array API with shell processing disabled.
  • Validate URLs with a URL parser and permit only https URLs on an explicit allowlist of supported Bilibili and YouTube hostnames.
  • Reject URLs containing credentials, unexpected ports, control characters, unsupported schemes, or malformed hostnames.
  • Add the -- end-of-options delimiter before URL arguments where the invoked utility supports it.
  • Use isolated, uniquely created working directories and run media-processing tools with the minimum required filesystem and network permissions.

SkillSpector

Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Using yt-dlp with --no-check-certificate disables TLS certificate validation for remote connections. This makes the download and metadata retrieval process vulnerable to man-in-the-middle interception or content tampering, which is especially risky because the skill fetches untrusted external media based on user-provided URLs.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

bash
# 1. 获取视频时长
yt-dlp --dump-json --no-check-certificate "URL" | jq -r '.duration, .title'

# 2. 下载音频
yt-dlp -f bestaudio --no-check-certificate "URL" -o audio.m4a

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The audio download command also disables certificate validation with --no-check-certificate, exposing the downloaded media to interception or tampering in transit. In the context of this skill, that can result in corrupted or maliciously altered content being processed locally by ffmpeg and whisper tooling.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
yt-dlp --dump-json --no-check-certificate "URL" | jq -r '.duration, .title'

# 2. 下载音频
yt-dlp -f bestaudio --no-check-certificate "URL" -o audio.m4a

# 3. 转码
ffmpeg -i audio.m4a -ar 16000 -ac 1 audio.wav

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger description is broad enough to activate on generic requests like summarizing a video, which can cause the skill to run in situations where the user did not explicitly consent to downloading or transcribing external media. In this skill, that broad activation increases the chance of unexpected network access, local file creation, and use of long-running tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The decision logic hard-codes language handling to Chinese or English only ('中文？用--language Chinese : 用--language en'), which imposes a locale constraint without offering user opt-in or indicating that the skill is intentionally limited to those languages. This is a natural-language policy concern because the skill appears to force language assumptions rather than letting the user choose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The workflow downloads media, writes audio and transcript files locally, and may process lengthy third-party content, but the skill description does not warn users about these side effects. That omission can lead to unexpected storage, privacy, and bandwidth impacts, especially when handling user-supplied URLs or sensitive content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.