ClawHub
Back to skill

Security audit

视频日语字幕

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the advertised subtitle workflow, but it can automatically send video transcript text to translation services and ships a hardcoded bearer token.

Review this skill before installing. Use it only for videos whose transcript can be shared with the configured QClaw gateway and, on failure, MyMemory. Rotate/remove the embedded token, disable external fallback unless explicitly needed, and restrict the input directory before running batch processing.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/subtitle_translate.py:36
Finding

Hard-Coded QClaw Bearer Token in Source Code

Content
View full analysis

Vulnerability Details

File Location: scripts/subtitle_translate.py:36
Vulnerability Type: Hard-coded authentication credential
Risk Level: Medium

Vulnerable Code

python
QCLAW_TOKEN = "78238b99f7ed3fb71de138d875005ac5a80274920af729fe"

The credential is subsequently added to the authorization header:

python
req = urllib.request.Request(
    QCLAW_GATEWAY,
    data=payload,
    headers={
        'Authorization': f'Bearer {QCLAW_TOKEN}',
        'Content-Type': 'application/json'
    }
)

Technical Analysis

A bearer token is embedded directly in the executable source code. Any person or process that can read the Skill package can recover this credential without needing elevated privileges.

Bearer tokens generally grant access based solely on possession. If the token remains active and is accepted by an accessible QClaw deployment, an attacker can replay it without knowing any additional secret. Although the default gateway address is localhost, this does not eliminate the exposure: the same token may be accepted by another deployment, the local gateway may be exposed through forwarding or configuration changes, or the source code may be copied to another environment.

Embedding credentials in source also causes them to persist in archives, package distributions, backups, and source-control history after the visible value is changed.

Attack Path

  1. An attacker obtains read access to the Skill package, an archive, a backup, or a repository containing the script.
  2. The attacker reads QCLAW_TOKEN from scripts/subtitle_translate.py.
  3. The attacker identifies a reachable QClaw-compatible gateway that accepts the token, including a locally exposed, forwarded, or separately deployed endpoint.
  4. The attacker submits requests with Authorization: Bearer <token>.
  5. If the credential remains valid, the gateway treats the attacker as the token holder.

Expl ...[truncated 730 chars]

Remediation
View remediation

Remediation Suggestions

  1. Revoke and rotate the exposed token immediately.
  2. Remove the token from the source code and all distributed copies.
  3. Load the replacement credential from an environment variable, operating-system credential store, or dedicated secret manager.
  4. Refuse to start translation when the credential is absent rather than supplying a working default.
  5. Ensure logs and exception messages never print authorization headers or token values.
  6. Grant the replacement token only the minimum API permissions and quota required.
  7. If the project is version-controlled, purge the credential from repository history while treating it as compromised regardless of history rewriting.
  8. Add automated secret scanning to packaging and continuous-integration workflows.

other

Warning
Location
scripts/subtitle_translate.py:210
Finding

Automatic Disclosure of Subtitle Content to an External Translation Service

Content
View full analysis

Vulnerability Details

File Location: scripts/subtitle_translate.py:210-212 and scripts/subtitle_translate.py:243-254
Vulnerability Type: Uncontrolled third-party data disclosure
Risk Level: Medium

Vulnerable Code

python
# 全部失败，回退到 MyMemory
print(f"    ⚠ LLM 翻译全部失败，回退 MyMemory...")
return translate_with_mymemory(texts)
python
def translate_with_mymemory(texts):
    """回退：用 MyMemory 翻译"""
    from deep_translator import MyMemoryTranslator
    translator = MyMemoryTranslator(source='ja-JP', target='zh-CN')
    results = []
    for text in texts:
        try:
            t = translator.translate(text)
            results.append(t if t else text)
            time.sleep(0.3)  # 避免限流
        except:
            results.append(text)  # 翻译失败保留原文
    return results

Technical Analysis

The normal translation path sends transcribed subtitle text to a gateway configured at 127.0.0.1. After all gateway attempts fail, the script automatically invokes deep-translator's MyMemoryTranslator, which submits each subtitle string to the MyMemory translation service.

Subtitle text is derived directly from video speech and may contain personal information, confidential discussions, unreleased media, copyrighted dialogue, or regulated data. The fallback changes the processing boundary from a local gateway to a third-party service without requesting affirmative consent at the point of transfer.

The fallback is mentioned in project documentation, so it is not concealed behavior. Nevertheless, there is no local-only mode, per-run approval, sensitivity check, or configuration flag that defaults to denying external disclosure.

Attack Path

  1. A user places a sensitive Japanese-language video in the configured input directory.
  2. Whisper transcribes the video into subtitle text.
  3. The local QClaw gateway becomes unavailable, rejects the credential, times out, or returns ma ...[truncated 1295 chars]
Remediation
View remediation

Remediation Suggestions

  1. Disable external translation fallback by default and fail closed when the local gateway is unavailable.
  2. Require an explicit configuration option, such as ALLOW_EXTERNAL_TRANSLATION=false, before initializing MyMemory.
  3. Request affirmative user consent before transmitting subtitle text to a third party.
  4. Display the external provider name, data being transmitted, and destination before transfer.
  5. Provide a strict local-only mode suitable for confidential content.
  6. Document the provider's privacy, retention, residency, and acceptable-use implications.
  7. Minimize transmitted content and avoid attaching filenames, metadata, credentials, or unnecessary context.
  8. Record whether an external fallback occurred without logging the subtitle content itself.
  9. Consider a locally hosted translation model as the preferred fallback.
  10. Treat gateway errors as processing failures when external transfer has not been explicitly authorized.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented purpose omits materially relevant behavior: sending subtitle/transcript content to a QClaw gateway, falling back to MyMemory online translation, using a hardcoded authentication token, and batch-processing fixed directories. This creates a real security and privacy risk because users may believe processing is local while sensitive audio-derived text is exfiltrated to external services, and hidden credentials or unattended batch actions expand blast radius.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill declares no explicit tool/permission scope even though its documented behavior requires shell execution, filesystem access, environment manipulation, and network access. In an agent environment, this weakens containment and user visibility, increasing the chance the skill can run with broader privileges than intended or be auto-invoked without appropriate review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger conditions are broad and include common phrases about subtitles and video processing, which can cause the skill to activate unintentionally in unrelated conversations. Because this skill performs file operations, shell execution, and possible network transmission, accidental invocation can lead to unintended processing of local media or data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill states that transcript content is sent to an LLM gateway but does not provide a clear privacy warning or explicit consent flow. Subtitle/transcript text may contain sensitive spoken content, so undisclosed external transmission can violate user expectations, confidentiality requirements, or policy boundaries.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The top-level process description says Step 6 verifies output with ffprobe plus frame-level visual spot checks, implying validation that subtitles were actually burned in. However, the later '待改进' section states the current implementation only checks duration and that frame extraction spot-checking is not yet implemented, so the documented end-to-end behavior overstates actual verification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The process overview presents Step 6 as 'ffprobe confirm duration + visual spot check,' suggesting the workflow already performs both checks. But the improvement list later says frame-capture spot checking is still pending and the current process only checks duration, which is a direct contradiction about implemented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The workflow sends subtitle/transcript content to a local LLM gateway and potentially to the external MyMemory API without a clear privacy warning or explicit user consent. Video transcripts can contain sensitive personal, business, or copyrighted content, so silent transmission to third-party services risks unintended disclosure and compliance issues.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a translation pipeline of Whisper transcription followed by LLM Japanese-to-Chinese translation, but this workflow adds a separate fallback to the MyMemory API. That changes the skill’s actual behavior from a local/declared gateway-based subtitle workflow into one that may send subtitle text to an additional external service not mentioned in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

A bearer token is hardcoded directly in the script, which exposes credentials to anyone with source access and encourages insecure secret handling practices. If reused in other environments or committed to a repository, the token can be harvested and abused to access the translation gateway or related services.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/subtitle_translate.py (reported line 86)May include surrounding context.

python
"-ar", "16000", "-ac", "1",
        str(audio_path)
    ]
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
    if result.returncode != 0:
        print(f"    ⚠ 音频提取失败: {result.stderr[-200:]}")
        return False

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill sends subtitle text to a local QClaw gateway and may fall back to MyMemory, an external translation service, but the skill description does not clearly disclose this data flow. Users may reasonably assume processing is local to Whisper/ffmpeg, so sensitive spoken content could be transmitted off-box without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Subtitle text derived from user videos is transmitted to translation services without any visible warning, consent flow, or privacy boundary. In this skill context, the content may contain private conversations, copyrighted dialogue, or sensitive business information, making silent transmission materially risky.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
88% confidence
Finding

The ffmpeg burn step loads an ASS subtitle file generated from transcribed and externally translated text, but the code does not escape ASS control syntax or neutralize special sequences before embedding text into Dialogue lines. Because libass/ffmpeg interprets subtitle formatting tags, untrusted subtitle content can alter rendering and, depending on parser behavior or future decoder bugs, expands the attack surface around a native media-processing pipeline.

Content

Scanner excerpt · scripts/subtitle_translate.py (reported line 347)May include surrounding context.

python
for label, cmd in [("NVENC GPU", cmd_nvenc), ("CPU libx264", cmd_cpu)]:
        print(f"    尝试 {label}...")
        try:
            result = subprocess.run(
                cmd,
                cwd=ass_dir,  # 关键：设置工作目录为字幕文件所在目录
                capture_output=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/subtitle_translate.py (reported line 378)May include surrounding context.

python
str(video_path)
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0 and result.stdout.strip():
            duration = float(result.stdout.strip())
            return duration > 0

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

L003 将技能定义为“将日语视频转换为中文硬字幕”，L113 也写明“当前只支持日语→中文”，表现为固定输出语言而未说明需用户主动选择中文。按自然语言策略，强制特定语言/locale 而不给用户选择可能构成语言政策问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The natural-language prompt instructs the translation system to always translate into Simplified Chinese, which is a language/locale constraint. Under SQP-3, forcing a specific language without user opt-in can be a policy violation unless the constraint is explicitly justified or optional.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The document shows a directory structure with temp and final outputs and then advertises one-click execution with automatic scanning and resumable processing, but it does not include a user warning that running the workflow will write multiple intermediate files and final rendered videos. For markdown files, file- and system-affecting behavior should be disclosed to the user.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The top-level documentation says the flow uses 'faster-whisper' for transcription and lists 'faster-whisper, deep-translator' as Python requirements, but the code imports 'whisper' in transcribe_audio and uses deep-translator only in a fallback path. This is an active mismatch between documented intent and actual implementation choices.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.