TikTok Text Overlay

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 8:27 AM UTC
• Version: 1.1.0

Overview

This skill appears to be a straightforward media text-overlay tool, with only ordinary local file handling and dependency-installation cautions.

Install this like a normal Python media utility: use a virtual environment or container, avoid running installs as an administrator, and be aware that unpinned dependencies may resolve to different versions over time.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7
• Finding: Unpinned Third-Party Dependencies in Skill Installation Metadata<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 7 and 21-25 **Vulnerability Type**: Unpinned third-party dependencies and non-reproducible installation **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"openclaw": {"emoji": "🎵", "requires": {"bins": ["python3"]}, "install": [{"type": "uv", "packages": ["Pillow", "moviepy"]}]}} ``` ```markdown Before using, ensure dependencies are installed: ```bash pip3 install Pillow moviepy ``` ``` ### Technical Analysis The Skill installation metadata and setup instructions install `Pillow` and `moviepy` without exact versions, cryptographic hashes, or a reviewed lockfile. Consequently, the installed code is resolved from mutable package-index state at installation time rather than from a reproducible set of audited artifacts. The dependency names are consistent with the Skill's legitimate image and video processing functionality, and no evidence indicates that the currently named packages are malicious. However, the installation configuration does not protect users if a package publishing account, package index, distribution artifact, or future dependency release is compromised. Python packages may execute code during installation or when imported. The effective code executed by the Skill can therefore change after the Skill itself has been reviewed. ### Attack Path 1. An attacker compromises a dependency publisher account, upstream release process, or configured Python package index. 2. The attacker publishes a malicious or backdoored release under one of the unpinned package names. 3. A user installs the Skill or follows the documented `pip3 install Pillow moviepy` command. 4. The package resolver selects the attacker-controlled release because no reviewed version or hash is enforced. 5. Malicious code executes during package installation or when the Skill imports the affected dependency. 6. The code runs with the privileges and filesystem/network access of the user or servi ...[truncated 674 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every direct dependency to an exact, reviewed version, for example: ```yaml "packages": ["Pillow==<reviewed-version>", "moviepy==<reviewed-version>"] ``` 2. Maintain a lockfile that includes resolved transitive dependencies. 3. Require cryptographic hashes for downloaded distributions, such as through a hash-pinned requirements file and `pip --require-hashes`. 4. Use an explicitly trusted package index and prevent unintended fallback to untrusted indexes. 5. Prefer reviewed wheel artifacts and record their hashes and provenance. 6. Run dependency installation and media processing as a non-privileged user in an isolated environment. 7. Establish a controlled dependency update process that includes vulnerability scanning, provenance verification, testing, and review before changing pinned versions. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:69
• Finding: Mutable Dependency and Repository Sources in Manual Installation Instructions<![CDATA[ ## Vulnerability Details **File Location**: `README.md`, lines 69-75 **Vulnerability Type**: Unpinned repository revision and third-party package versions **Risk Level**: Medium ### Vulnerable Code ```bash git clone https://github.com/xmuweili/tiktok-overlay.git cd tiktok-overlay pip install Pillow moviepy ``` ### Technical Analysis The manual installation procedure clones the repository's current default branch and installs the latest resolver-selected versions of `Pillow` and `moviepy`. Neither the repository state nor the package artifacts are pinned to reviewed immutable identifiers. A Git branch can change after an audit, and package names without exact versions resolve against mutable package-index state. Users following these instructions at different times may therefore receive materially different code. HTTPS protects the connection in transit but does not make a branch or package release immutable. No evidence was found that the referenced repository or dependencies are currently malicious. The risk arises from the absence of controls that bind installation to specific reviewed commits and package artifacts. ### Attack Path 1. An attacker compromises the upstream Git repository, a maintainer account, a dependency publication account, or a package distribution channel. 2. The attacker modifies the default branch or publishes a malicious dependency release. 3. A user follows the README and clones the current branch without checking out a reviewed commit. 4. The user installs dependencies without version or hash restrictions. 5. The malicious repository code or dependency is executed during installation, import, or Skill invocation. 6. Execution occurs with the permissions of the user or automation service that followed the installation procedure. ### Impact Assessment A compromised repository revision could replace any part of the Skill and obtain arbitrary code execution when the scripts are invoked. A compromised dependency could ex ...[truncated 540 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the mutable clone instruction with a checkout of a reviewed commit: ```bash git clone https://github.com/xmuweili/tiktok-overlay.git cd tiktok-overlay git checkout --detach <reviewed-full-commit-hash> ``` 2. Publish signed releases or tags and document how users should verify their signatures. 3. Pin direct and transitive Python dependencies in a lockfile. 4. Include cryptographic hashes for all dependency artifacts and require hash verification during installation. 5. Document the expected repository commit and dependency-lockfile digest for each released Skill version. 6. Install inside a dedicated virtual environment or isolated container under a non-privileged account. 7. Review and test repository and dependency updates before updating the documented commit, versions, or hashes. ]]>

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The code substantially matches the image-overlay portion of the description: it applies TikTok-style text overlays with styled fonts, backgrounds, strokes, positioning, and multiple overlays. However, it does not implement video support or any timed animation behavior despite those being explicitly declared. It only handles static images (file path, PIL image, numpy array, or bytes) and saves processed images to disk when requested. Additionally, although file I/O is expected for an image tool, the declared permissions list is empty while the code reads and writes local files. The main mismatch is that the declared scope includes videos and timed animations, which are not present in the actual code.

Static analysis

No suspicious patterns detected.