ClawHub
Back to skill

Security audit

Video to Text

Security checks for vulnerabilities and agentic risk

Overview

The skill’s video transcription purpose is coherent, but its helper script has a real local code-execution flaw and disables TLS checks for downloads.

Install only if you are comfortable reviewing or fixing the script first. At minimum, remove the generated python -c execution pattern, keep TLS certificate verification enabled, use pinned dependencies in a virtual environment, and treat video URLs and prompts as untrusted input.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/transcribe.py:61
Finding

Arbitrary Code Execution Through Dynamically Generated Python Source

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/transcribe.py:26
Finding

TLS Certificate Verification Disabled for Video Downloads

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Unpinned Third-Party Runtime Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (12)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

Using --no-check-certificates disables TLS certificate validation for video downloads, making the tool susceptible to man-in-the-middle attacks and content spoofing. An attacker on the network path could tamper with the downloaded media or redirect requests to malicious content, which is especially risky because the skill processes untrusted remote resources automatically.

Content

Scanner excerpt · scripts/transcribe.py (reported line 30)May include surrounding context.

python
cmd = [
        "yt-dlp", url,
        "-o", output_path,
        "--no-check-certificates",
        "--no-update"
    ]
    print("[1/2] 正在下载视频...")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill advertises shell, environment-variable, and file access behavior but does not declare any tool scope or permissions boundaries. That increases the chance an agent may invoke it with broader capabilities than the user expects, especially because the workflow downloads files, installs dependencies, and reads persistent configuration.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

pip install yt-dlp openai-whisper winget install ffmpeg # Windows

brew install ffmpeg # macOS

sudo apt install ffmpeg # Linux

text

## First-time Setup

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

The skill recommends creating persistent global yt-dlp configuration under user profile directories, which changes future downloader behavior outside this skill session. Persistent config can surprise users, affect unrelated workflows, and increase the blast radius if unsafe options are later added or if sensitive paths are exposed.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

yt-dlp global config (optional)

bash
# Windows: Create %APPDATA%\yt-dlp\config (one line):
-o X:\video_downloads\%(title)s.%(ext)s

# macOS/Linux: Create ~/.config/yt-dlp/config (one line):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description does not clearly warn that it will download remote video content and save files locally. Users may provide untrusted URLs without realizing the skill performs network retrieval and persistent local storage, which can create privacy, disk-usage, and policy-consent issues.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 34)May include surrounding context.

python
"--no-update"
    ]
    print("[1/2] 正在下载视频...")
    result = subprocess.run(cmd, capture_output=True, text=True, encoding='utf-8', errors='replace')
    if result.returncode != 0 and "already downloaded" not in result.stderr:
        print(f"下载失败: {result.stderr}")
        sys.exit(1)

Tainted flow: 'cmd' from os.environ.get (line 27, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/transcribe.py (reported line 34)May include surrounding context.

python
"--no-update"
    ]
    print("[1/2] 正在下载视频...")
    result = subprocess.run(cmd, capture_output=True, text=True, encoding='utf-8', errors='replace')
    if result.returncode != 0 and "already downloaded" not in result.stderr:
        print(f"下载失败: {result.stderr}")
        sys.exit(1)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The embedded Whisper call hard-codes language='zh', which enforces a specific language/locale behavior for all inputs. The file does not offer an opt-in, parameter, or justification for this restriction, so it fits the policy category for language or locale constraints without user choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

The script dynamically builds Python source code with f-string interpolation and executes it via python -c. User-controlled prompt and the discovered video_path are inserted directly into Python string literals, so crafted input containing quote/newline sequences can break out of the string and execute arbitrary Python code in the spawned interpreter.

Content

Scanner excerpt · scripts/transcribe.py (reported line 91)May include surrounding context.

python
print('---FULLTEXT---')
print(result['text'])
"""
    result = subprocess.run(
        ["python", "-c", python_code],
        capture_output=True, text=True, encoding='utf-8', errors='replace'
    )

Tainted flow: 'python_code' from os.environ.get (line 61, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
99% confidence
Finding

This is a true code-execution issue because environment-derived WHISPER_DOWNLOAD_ROOT and video_path are interpolated into a Python program string that is then executed with python -c. An attacker controlling the environment or influencing the file name/path can inject Python statements and achieve arbitrary code execution.

Content

Scanner excerpt · scripts/transcribe.py (reported line 91)May include surrounding context.

python
print('---FULLTEXT---')
print(result['text'])
"""
    result = subprocess.run(
        ["python", "-c", python_code],
        capture_output=True, text=True, encoding='utf-8', errors='replace'
    )

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The manifest description is written only in Chinese while the rest of the skill documentation is in English, which can impose a language assumption on users or tooling consuming the manifest. There is no indication that the skill is intentionally region-specific or that users can choose their preferred language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

清单描述强调的是从视频链接下载并转录为文字，通常可理解为以转录为目的的处理中间步骤。代码在完成转录后明确保留视频文件并输出保存路径，实际行为包含本地持久化媒体内容，而不仅是为转录临时下载。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.