PPT Voiceover · Slide Narration with Subtitles

• Outcome: Pass
• Latest audit: Nov 9, 2026 · 4:22 AM UTC
• Version: 1.0.0

Overview

ClawScan verdict: benign, with medium confidence; the findings are assessed as consistent with a slide narration and voiceover skill, though the scan was partial and found a mismatch between the advertised workflow and the behavior covered by the evidence.

The verdict is benign, but not risk-free. Before installing, consider that the scan covered 6 of 7 components and was partial; the advertised slide-to-video workflow was not fully evidenced, tool permissions were not verified, and API calls may lack explicit timeouts. Review the skill's declared capabilities and confirm the workflow you need is actually provided.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code implements the underlying narration functionality but materially differs from the declared slide-to-video workflow. Its timing, caching, and output organization operate on script lines rather than slides, and the central slide-specific and video-generation capabilities are absent from the supplied chunk. API delegation, local audio processing, speaker selection, and dry-run behavior are consistent with the description; there is no evident unrelated or malicious capability.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code implements an API-client component relevant to the advertised workflow, but not the central slide-processing and assembly behavior described. Its API access, text submission, audio uploads for subtitles, and output-file writes are consistent supporting operations, rather than evidence of unrelated or malicious activity. Nevertheless, evaluated on this chunk alone, the declared end-to-end workflow materially exceeds the implemented functionality. Other files could supply the missing orchestration, but none are present in the supplied evidence.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/miragea_audio.py (reported line 40)May include surrounding context.

python

self.timeout = timeout
        self.opener = urllib.request.build_opener(NoRedirect())

    def request(self, method, path, payload=None, content_type=None, key=None, timeout=None):
        headers = {'Authorization': 'Bearer ' + self.key, 'Accept': 'application/json'}
        if content_type:
            headers['Content-Type'] = content_type

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/miragea_audio.py (reported line 59)May include surrounding context.

python

except (urllib.error.URLError, TimeoutError, OSError, ValueError) as exc:
            raise ClientError({'error': {'code': 'request_failed', 'message': 'API request failed; submission outcome may be unknown. Reuse the same idempotency key for the same payload.'}}) from None

    def task(self, task_id, timeout=None):
        return self.request('GET', '/tasks/' + urllib.parse.quote(task_id, safe=''), timeout=timeout)

    def capabilities(self):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/slides.py (reported line 116)May include surrounding context.

python

if getattr(a, flag):
                cmd.append("--" + flag.replace("_", "-"))
        print("page %02d  %s" % (no, title), file=sys.stderr)
        r = subprocess.run(cmd)
        if r.returncode != 0:
            raise SystemExit("page %02d failed (exit %d); fix it and re-run: finished pages are reused from their lines/ cache" % (no, r.returncode))
        with wave.open(os.path.join(folder, "voiceover.wav"), "rb") as w:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/voiceover.py (reported line 163)May include surrounding context.

python

cmd += [flag, str(p[k])]
    for t in p.get("tags", []):
        cmd += ["--tag=" + t]
    r = subprocess.run(cmd, capture_output=True, text=True)
    if r.returncode != 0 or not os.path.exists(out_path):
        sys.stderr.write(r.stdout + r.stderr)
        raise ScriptError("generate failed for: %s... Re-run the same command to resume; the same idempotency key "

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/miragea_audio.py (reported line 203)May include surrounding context.

python

raise ValueError('--reference-text requires --reference-audio-url.')
                payload = {'text': args.text if args.text is not None else args.text_file.read_text(encoding='utf-8')}
                for field in ('actor_id', 'reference_audio_url', 'reference_text', 'model', 'format', 'speed', 'tags', 'language'):
                    value = getattr(args, field)
                    if value is not None:
                        payload[field] = value
                result = client.request('POST', '/audio/generations', json.dumps(payload).encode(), 'application/json', submission_key)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/slides.py (reported line 109)May include surrounding context.

python

f.write(front + body + "\n")
        cmd = [sys.executable, os.path.join(HERE, "voiceover.py"), "script", src, "-o", folder]
        for opt in ("preset", "gap", "max_chars", "model"):
            v = getattr(a, opt)
            if v is not None:
                cmd += ["--" + opt.replace("_", "-"), str(v)]
        for flag in ("dry_run", "fresh", "speaker_labels"):

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/slides.py (reported line 113)May include surrounding context.

python

if v is not None:
                cmd += ["--" + opt.replace("_", "-"), str(v)]
        for flag in ("dry_run", "fresh", "speaker_labels"):
            if getattr(a, flag):
                cmd.append("--" + flag.replace("_", "-"))
        print("page %02d  %s" % (no, title), file=sys.stderr)
        r = subprocess.run(cmd)