ClawHub
Back to skill

Security audit

Openclip

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent OpenClip connector, but users should understand that media is processed by a remote service and outputs may be permanent links.

Install this only if you are comfortable connecting an OpenClip account and sending selected videos, images, URLs, and related metadata to openclip.app for processing. Prefer OAuth over copying manual tokens, and avoid private or sensitive media unless permanent CDN output links and the provider's retention practices are acceptable.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · reference.md (reported line 77)May include surrounding context.

md
- The OpenClip MCP server is **remote over HTTP**, production URL `https://openclip.app/mcp`
  (shown on the connect page).
- **Primary, OAuth one-click:** paste the server URL into your client and sign in with your
  OpenClip account (the connector runs OAuth 2.1 in the browser; access token carries scope
  `mcp:use`). No token to copy.
- **Alternative, manual Bearer token:** for header-only / programmatic clients, mint a token
  (ability `mcp:use`) on the connect page (openclip.app/settings/connect → "Generate MCP token")

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes very broad phrases such as 'transcribe this', 'compress this video', 'remove the background', and 'make shorts', which can match common user requests outside a clearly scoped OpenClip invocation. This can cause the skill to activate unexpectedly and route user media-processing requests to this remote service when the user did not explicitly choose it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

These setup instructions direct the agent to connect to a third-party remote MCP server and transmit user-provided URLs and account credentials, but they do not prominently warn that media and metadata leave the local environment. In practice, users may believe actions are local or agent-native when their content is being processed by an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs the agent to upload local files via create_upload and PUT raw bytes to a remote service for transcription, editing, conversion, and background removal, but does not clearly warn about privacy, retention, or third-party handling. Because these operations involve direct transfer of user media, sensitive personal or proprietary content could be disclosed without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation states that clip URLs and completed output URLs are permanent CDN URLs, but it does not clearly explain that permanence increases the risk of long-term exposure and easy resharing if links are leaked. Users may assume outputs are temporary or access-controlled when they are effectively durable public artifacts.

Content

No source excerpt is available for this finding.