ClawHub
Back to skill

Security audit

基于需求描述智能生成脚本和视频，让你的每个营销视频都出彩。适用于用户希望“把这个需求直接生成视频”时，通过API自动生成结果而非人工撰写。

Security checks for vulnerabilities and agentic risk

Overview

This video-generation skill does its stated job, but it ships and automatically uses a reusable bearer token and can send that token to an arbitrary configured server.

Review before installing. This skill should not ship with a shared bearer token; require a per-user secret, restrict the API origin to the intended Xiaonian HTTPS endpoint, and avoid submitting sensitive campaign or business details until the authentication and endpoint handling are fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/video_quick_gen.py:67
Finding

Hard-Coded Bearer Token Distributed in Source Code

Content
View full analysis

Vulnerability Details

File Location: scripts/video_quick_gen.py, lines 67–72
Vulnerability Type: Hard-coded authentication secret
Risk Level: High

Vulnerable Code

python
DEFAULT_TOKEN = "atk_ajhhuxTyHciMIxZQ_vt_boqVeG_zTr4Ix9REWuVBXSc"


def _get_token(base_url: str) -> Tuple[Optional[str], Optional[str]]:
    token = os.getenv("DASHBOARD_TOKEN") or DEFAULT_TOKEN
    if token:
        return token, "env:DASHBOARD_TOKEN"

Technical Analysis

The source code contains a static, reusable bearer token and automatically uses it whenever DASHBOARD_TOKEN is absent. The accompanying SKILL.md also describes authentication as a built-in token requiring no configuration.

Embedding credentials in a distributable Skill package violates secret-management and least-privilege principles. Any user or process with read access to the package can recover the token without executing the Skill. The token is subsequently placed in an HTTP Authorization header and used to access the dashboard video API.

The token's current validity and exact server-side authorization scope were not verified during this static audit. Nevertheless, it has the form and use of an operational access token and must be treated as compromised.

Attack Path

  1. An attacker obtains or reads the Skill package.
  2. The attacker opens scripts/video_quick_gen.py and extracts DEFAULT_TOKEN.
  3. The attacker sends requests to the dashboard API with:
    http
    Authorization: Bearer atk_ajhhuxTyHciMIxZQ_vt_boqVeG_zTr4Ix9REWuVBXSc
  4. The API processes requests under the identity and permissions assigned to that token.
  5. The attacker can continue using the credential until it expires or is revoked.

Impact Assessment

Successful exploitation may allow unauthorized creation and monitoring of video-generation tasks, consumption of service quotas, abuse of account resources, and access to any additional API oper ...[truncated 279 chars]

Remediation
View remediation

Remediation Suggestions

  1. Revoke and rotate the exposed token immediately.
  2. Remove the token from the current source, release artifacts, examples, documentation, and version-control history.
  3. Require authentication through a protected environment variable, operating-system credential store, or managed secret service.
  4. Fail closed when no credential is configured rather than falling back to an embedded token.
  5. Issue short-lived, per-user or per-installation credentials instead of a shared token.
  6. Restrict tokens to the minimum API operations and quotas required for video generation.
  7. Add automated secret scanning to development and release pipelines.
  8. Audit server logs for prior use of the exposed credential and investigate unexpected tasks, source addresses, or resource consumption.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/video_quick_gen.py:113
Finding

Bearer Token Can Be Sent to an Arbitrary Caller-Controlled Server

Content
View full analysis

Vulnerability Details

File Location: scripts/video_quick_gen.py, lines 113–165
Vulnerability Type: Credential disclosure through an unrestricted service endpoint
Risk Level: High

Vulnerable Code

python
ap.add_argument("--base-url", default=os.getenv("DASHBOARD_BASE_URL", DEFAULT_DASHBOARD_BASE_URL), help="Dashboard base url")
python
args = ap.parse_args()

base_url = args.base_url.rstrip("/")
api_base = base_url + API_PREFIX

# token required for task/create
token, _src = _get_token(base_url)
if not token:
    sys.stderr.write("Missing auth. Set env DASHBOARD_TOKEN, or set DASHBOARD_PHONE + DASHBOARD_PASSWORD for login.\n")
    return 3

headers_auth = {"Authorization": f"Bearer {token}"}

# 1) script
try:
    resp = _http_json(
        "POST",
        api_base + "/video/script/gen",
        body={
            "video_type": args.video_type,
            "request_desc": args.request,
            "duration": int(args.duration),
            "has_subtitle": bool(args.has_subtitle),
        },
        headers=headers_auth,
        timeout_s=300,
    )

Technical Analysis

The API base URL can be supplied through either the --base-url command-line option or the DASHBOARD_BASE_URL environment variable. The code performs no validation of the URL scheme or hostname before attaching the bearer token to the request.

Consequently, a malicious invocation, wrapper, or poisoned environment can redirect authenticated traffic from the intended https://xiaonian.cc service to an attacker-controlled HTTP or HTTPS endpoint. The first script-generation request sends both the bearer token and the user's video request to that endpoint.

This configurability is not required for the documented production workflow, which declares a fixed service base. Combining an arbitrary destination with automatic credential forwarding exceeds the minimum privileges needed by the Skil ...[truncated 2035 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the production --base-url override and always use the documented service endpoint if alternate servers are not operationally required.
  2. If endpoint configurability is required, enforce an explicit allowlist of trusted HTTPS origins, such as exactly https://xiaonian.cc.
  3. Parse the URL and validate:
    • The scheme is https.
    • The normalized hostname is explicitly approved.
    • The effective port is approved.
    • User-information fields are absent.
    • The URL does not resolve to an unexpected local or private destination.
  4. Validate redirect destinations and never forward authentication headers across origins.
  5. Associate each credential with its permitted origin and refuse to attach it to any other destination.
  6. Avoid inheriting security-sensitive endpoint configuration from an untrusted environment.
  7. Display or log the validated destination without exposing credentials before initiating remote processing.
  8. Add tests confirming that HTTP URLs, lookalike domains, subdomain tricks, embedded credentials, and cross-origin redirects are rejected.
  9. Clearly disclose that video requirements and generated content are transmitted to the external service so users can avoid submitting inappropriate sensitive data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared purpose says the skill generates marketing videos, but the content also reveals undeclared sensitive behaviors: built-in token authentication, possible credential-based login, and optional local file download/write. Hidden authentication and file-write capabilities materially change the trust model because a caller may invoke the skill without realizing it can use stored credentials or write artifacts locally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

A hard-coded default bearer token is embedded directly in the script and used automatically when no environment token is set. Anyone with access to the code can reuse that token, and the skill may silently operate under an unintended account, leading to unauthorized API use, billing abuse, data exposure, or impersonation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script silently falls back to an embedded authentication token without notifying the user, so operations may execute under hidden credentials. In an agent skill, this removes transparency and prevents users from understanding whose account is being charged or accessed, while also normalizing use of a leaked secret.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares no explicit tool scope or permission boundaries even though it clearly relies on network access and likely environment-backed authentication. This weakens least-privilege controls and makes it harder for a host agent or reviewer to understand what the skill is allowed to do, increasing the chance of unintended outbound requests or secret use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation phrases are broad everyday requests such as '生成一个视频' and '做个视频', which can cause the skill to trigger in routine conversation without clear user intent to use this specific external service. In this context, accidental activation is more dangerous because the skill can make authenticated network calls and potentially create remote tasks or download files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The manifest description is written entirely in Chinese and defines the skill's invocation behavior in Chinese phrases only, which implies a language-specific interaction model without offering any user choice or opt-in. This can violate language/locale policy when the skill is used in broader multilingual environments.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill contains credential-handling logic that can log in with phone/password from environment variables, which is unnecessary for a narrowly scoped video-generation helper if a token is expected to be supplied externally. This expands the secret surface area and encourages the skill to process primary credentials, increasing the risk of credential misuse, leakage, or unintended account access in an automated agent context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

When --out is provided, the script downloads remote content and writes it to disk, creating directories as needed. Although the code performs the write directly, it does not provide a user-facing warning, confirmation, or log message specifically disclosing that a network-fetched file will be written locally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.