ClawHub
Back to skill

Security audit

Video Transcribe

Security checks across malware telemetry and agentic risk

Overview

The skill’s video transcription purpose is clear, but its helper script can turn a user-supplied prompt or crafted environment path into local Python code execution.

Review before installing. Only use this skill with trusted prompt text and trusted environment paths, because a crafted prompt or path could execute local Python code. Prefer a fixed version that calls Whisper directly or passes inputs through safe structured arguments instead of generating python -c source. Also confirm where videos and model files will be stored, and avoid the optional global yt-dlp config unless you want it to apply beyond this skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
print('---FULLTEXT---')
print(result['text'])
"""
    result = subprocess.run(
        ["python", "-c", python_code],
        capture_output=True, text=True, encoding='utf-8', errors='replace'
    )
Confidence
98% confidence
Finding
The script builds Python source code via string interpolation and executes it with `python -c`. Because `prompt` and `video_path` are inserted directly into Python string literals without robust escaping, an attacker can break out of the string and inject arbitrary Python code, leading to code execution in the local environment.

Tainted flow: 'python_code' from os.environ.get (line 61, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
print('---FULLTEXT---')
print(result['text'])
"""
    result = subprocess.run(
        ["python", "-c", python_code],
        capture_output=True, text=True, encoding='utf-8', errors='replace'
    )
Confidence
97% confidence
Finding
This is a real tainted-code-execution path: environment-derived paths and user-controlled prompt data flow into `python_code`, which is then executed with `python -c`. Any quote/newline sequence that escapes the intended literal can inject arbitrary Python statements and fully compromise the host process context.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill documents shell execution, environment variable usage, and file system interaction, but the metadata declares no permissions. This creates a transparency and consent problem: users or hosting agents may invoke a capability that downloads files, writes persistent configuration, and reads environment settings without an explicit permission declaration. In this context, the behavior is expected for a video transcription skill, but the missing declaration still makes the skill more dangerous because it obscures its operational scope.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill description says it transcribes from video links, but does not prominently warn that it will first download and save the full video locally. That omission can mislead users about storage, bandwidth, privacy, and copyright implications, especially when processing sensitive or private links. The context makes this a real issue because local persistence is core behavior, not an incidental implementation detail.

Session Persistence

Medium
Category
Rogue Agent
Content
### yt-dlp global config (optional)

```bash
# Windows: Create %APPDATA%\yt-dlp\config (one line):
-o X:\video_downloads\%(title)s.%(ext)s

# macOS/Linux: Create ~/.config/yt-dlp/config (one line):
Confidence
89% confidence
Finding
The skill recommends creating a global yt-dlp config in a persistent user configuration directory, which changes behavior across future sessions and potentially across unrelated uses of yt-dlp. This persistence can have unintended side effects, such as silently redirecting downloads to a specific path or causing other tools and workflows to inherit modified behavior. In context, the recommendation is framed as optional setup, so it is less severe than hidden persistence, but it still introduces durable state that users may not fully understand.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.