Talking-Head Voiceover · Voice Cloning · Subtitles

• Outcome: Pass
• Latest audit: Nov 9, 2026 · 4:20 AM UTC
• Version: 1.0.1

Overview

ClawScan’s verdict is benign with medium confidence: the skill appears focused on voiceover and subtitle work, though scanners report mismatches between advertised and implemented features and the review evidence is partial.

The verdict is benign, but consider the medium confidence and partial Skillspector analysis before installing. Check that the advertised workflow limitations are acceptable, that you are comfortable with media being sent to Miragea for recognition, and that the skill’s required tool access fits your needs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The core API-based voice-generation behavior matches the description, and audio upload for subtitle recognition reasonably supports the subtitle feature. However, the supplied script materially underimplements explicit workflow claims, especially offline --dry-run operation and sentence-level timeline/regeneration support. Its JSON output option saves a task result, not an explicitly constructed per-sentence manifest. No unrelated execution or covert data collection is evident in this chunk; the mismatch concerns advertised functionality rather than demonstrated malicious behavior.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The existing-video transcription workflow does not warn that the supplied media is sent to a third-party service.

Medium

• Category: Output Handling
• Confidence: 86% confidence

Finding

The skill instructs the agent to run cloud-backed recognition on a local video without telling the user that the media will be transmitted to Miragea. Although Miragea is identified as the service provider elsewhere, the upload and its privacy implications for existing recordings are not disclosed in this workflow.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/miragea_audio.py (reported line 40)May include surrounding context.

python

self.timeout = timeout
        self.opener = urllib.request.build_opener(NoRedirect())

    def request(self, method, path, payload=None, content_type=None, key=None, timeout=None):
        headers = {'Authorization': 'Bearer ' + self.key, 'Accept': 'application/json'}
        if content_type:
            headers['Content-Type'] = content_type

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/miragea_audio.py (reported line 59)May include surrounding context.

python

except (urllib.error.URLError, TimeoutError, OSError, ValueError) as exc:
            raise ClientError({'error': {'code': 'request_failed', 'message': 'API request failed; submission outcome may be unknown. Reuse the same idempotency key for the same payload.'}}) from None

    def task(self, task_id, timeout=None):
        return self.request('GET', '/tasks/' + urllib.parse.quote(task_id, safe=''), timeout=timeout)

    def capabilities(self):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/voiceover.py (reported line 163)May include surrounding context.

python

cmd += [flag, str(p[k])]
    for t in p.get("tags", []):
        cmd += ["--tag=" + t]
    r = subprocess.run(cmd, capture_output=True, text=True)
    if r.returncode != 0 or not os.path.exists(out_path):
        sys.stderr.write(r.stdout + r.stderr)
        raise ScriptError("generate failed for: %s... Re-run the same command to resume; the same idempotency key "

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/miragea_audio.py (reported line 203)May include surrounding context.

python

raise ValueError('--reference-text requires --reference-audio-url.')
                payload = {'text': args.text if args.text is not None else args.text_file.read_text(encoding='utf-8')}
                for field in ('actor_id', 'reference_audio_url', 'reference_text', 'model', 'format', 'speed', 'tags', 'language'):
                    value = getattr(args, field)
                    if value is not None:
                        payload[field] = value
                result = client.request('POST', '/audio/generations', json.dumps(payload).encode(), 'application/json', submission_key)