ClawHub
Back to skill

Security audit

小云雀短剧创作

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for a short-drama creation service, but it gives an external CLI and service-directed downloads broad authority to submit user content and write generated files locally without enough containment.

Review this before installing if you are not intentionally using the Xiao Yunque/Pippit short-drama service. Expect your prompts and selected .doc/.docx/.txt reference files to be sent to the service, credentials to be stored by the CLI, links to be opened, and generated assets to be downloaded locally. Prefer pinning the CLI version and only running it in a workspace where service-created output paths cannot overwrite important files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger scope is extremely broad, covering generic creative requests like writing stories, modifying plots, character settings, and script drafting. In context, that means the skill may activate for ordinary conversation and then submit user content to an external backend, open links, poll tasks, and download files without the user clearly intending to invoke this toolchain.

Natural-Language Policy Violations

Medium
Confidence
72% confidence
Finding
The skill is presented entirely as '小云雀短剧创作' with Chinese-only operational instructions and examples, but it does not state that the tool is region-specific or give the user a language choice. This can be read as forcing a specific language/locale without opt-in, which falls under the policy's language/locale concern.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill repeatedly instructs the agent to automatically download 'important assets' from returned `download_url` values and write them directly to local `file_path` locations. Because these paths and URLs originate from an external service, this creates a risky automatic write flow with limited user visibility, potentially causing unexpected local file creation, overwrites, or storage of unsafe content.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding
The skill tells users to install and run a CLI via `npx @pippit-dev/cli@latest`, which is not pinned to an exact version or integrity-verified release. That creates a supply-chain risk: a compromised or breaking upstream release could be fetched at execution time and then used for authentication, file upload, and local file writes.

Static analysis

No suspicious patterns detected.