ClawHub

yby6-video-parser

Security checks across malware telemetry and agentic risk

Overview

The skill appears to do video parsing and transcription as described, but it needs review because it can fetch loosely validated URLs, upload extracted audio to SiliconFlow, and retain media/transcripts locally.

Install only if you are comfortable with the skill contacting video platforms, sending extracted audio to SiliconFlow for transcription, and storing generated reports and temporary media locally. Avoid using it on untrusted or attacker-supplied links until URL allowlisting and redirect validation are tightened, and enable temp cleanup for sensitive content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Tainted flow: 'files' from open (line 188, file read) → requests.post (network output)

High
Category
Data Flow
Content
data = {
            "model": model
        }
        response = requests.post(DEFAULT_API_BASE_URL, headers=headers, files=files, data=data, timeout=600)
        response.raise_for_status()

        result = response.json()
Confidence
96% confidence
Finding
response = requests.post(DEFAULT_API_BASE_URL, headers=headers, files=files, data=data, timeout=600)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documentation describes capabilities that include network access, shell execution, local file reads, and local file writes, but no permissions are explicitly declared. This creates a trust and review gap: users may invoke a skill with broader side effects than expected, including downloading media, reading `.env`, and writing reports or temporary files.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The description presents the skill mainly as a parser/transcriber, but the documented behavior also includes local persistence, reading secrets from `.env`, optional external API usage, and command-line driven automation. This mismatch can mislead users and integrators about the real security boundary and data flows, increasing the chance of unintended data exposure or execution in overly permissive environments.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill exports and implements a generic .env loader that is outside the stated video parsing/transcription purpose, increasing the attack surface for secret discovery. In an agent-skill context, exposing environment-reading helpers can enable unintended access to sensitive configuration if other components invoke it with attacker-controlled paths.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README describes transcription and Markdown export while only later indirectly mentioning tmp/ and demos/ directories, without clearly warning that downloaded media, extracted audio, transcripts, and generated reports may persist on disk. In a tool that processes potentially sensitive third-party content, this can lead to unintentional local data retention and exposure to other users or backup/sync systems.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The README instructs users to configure a SiliconFlow API key for transcription but does not clearly state that video/audio content or derived audio will be transmitted to an external third-party service. This creates a privacy and compliance risk because users may submit copyrighted, confidential, or personal content without informed consent.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The parser performs a server-side HTTP GET to a caller-supplied `share_url` with no allowlist, validation, or user disclosure. In a video-parsing skill, this creates an SSRF surface: an attacker can supply internal or unexpected URLs and cause the host running the skill to make outbound requests, potentially reaching internal services or leaking network metadata.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The code performs an HTTP GET to a user-controlled `share_url` with redirects enabled and no apparent allowlist or validation of the destination. This creates a server-side request forgery risk: an attacker can cause the service to connect to arbitrary hosts, potentially including internal network services, cloud metadata endpoints, or unexpected external systems, and the automatic redirect behavior broadens the reachable target set.

Missing User Warnings

Low
Confidence
93% confidence
Finding
The code performs an outbound HTTP request directly to a user-supplied `share_url` before validating that it belongs to an expected XiGua domain. This creates an SSRF-style risk: an attacker could supply an arbitrary URL and cause the service to connect to internal services, cloud metadata endpoints, or other restricted network locations, especially dangerous if this parser runs on server infrastructure.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
Audio files are transmitted to an external API without any explicit warning or consent flow in the script. Because this skill processes user-supplied video links and extracts speech, the uploaded content may contain sensitive personal or confidential information, making undisclosed transfer a meaningful privacy vulnerability.

External Transmission

Medium
Category
Data Exfiltration
Content
# 示例: parse_api_url=http://ip:8000/video/share/url/parse?url=
parse_api_url=

# SiliconFlow ASR API 地址 (可选，默认: https://api.siliconflow.cn/v1/audio/transcriptions)
siliconflow_api_url=https://api.siliconflow.cn/v1/audio/transcriptions

# 是否自动清理临时文件 (可选，默认: false)
Confidence
84% confidence
Finding
https://api.siliconflow.cn/

External Transmission

Medium
Category
Data Exfiltration
Content
parse_api_url=

# SiliconFlow ASR API 地址 (可选，默认: https://api.siliconflow.cn/v1/audio/transcriptions)
siliconflow_api_url=https://api.siliconflow.cn/v1/audio/transcriptions

# 是否自动清理临时文件 (可选，默认: false)
# true: 自动删除临时文件（视频和音频）
Confidence
90% confidence
Finding
https://api.siliconflow.cn/

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal