ClawHub
Back to skill

Security audit

briefing

Security checks across malware telemetry and agentic risk

Overview

This skill has a plausible video transcription purpose, but it can automatically run an installer that fetches remote code, uses sudo, writes a global launcher, and changes shell startup files without a clear consent boundary.

Install only if you are comfortable with a skill that can run shell setup automatically, install system packages with sudo, clone code from GitHub at install time, install Python dependencies from that clone, and modify your PATH persistently. Prefer reviewing the repository and requirements first, running setup manually in a sandbox or disposable environment, and avoiding privileged/global install paths unless you explicitly want them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill explicitly requires shell execution and can invoke an install script, yet it declares no permissions or equivalent warning in the manifest. This creates a transparency and consent failure: users may invoke a skill that can run commands and modify the environment without clear upfront disclosure.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The stated purpose is channel tracking and transcription, but the documented behavior includes bootstrap installation patterns associated with system modification, dependency installation, PATH changes, and fetching code. That mismatch is dangerous because it expands trust boundaries well beyond the declared use case and can lead to arbitrary system changes or supply-chain exposure under the guise of a simple media-processing skill.

Description-Behavior Mismatch

Medium
Confidence
82% confidence
Finding
The manifest presents the skill as passive tracking/transcription, but the CLI also supports mutating persistent state through add, delete, and config changes. This broader authority is not inherently malicious, but under-disclosed state mutation can cause unintended data loss, persistent behavior changes, or abuse if the agent is prompted ambiguously.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
`briefing -set <KEY> <VALUE>` exposes arbitrary configuration mutation without any visible allowlist or scope restriction in the skill contract. If the underlying CLI supports sensitive keys such as paths, hooks, network endpoints, or execution options, this becomes a powerful primitive for persistence, data exfiltration, or unsafe command behavior.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The installer persistently modifies the user's shell startup files to prepend a launcher directory to PATH without prompting or clearly warning the user. This is unnecessary for simple local execution and creates lasting environment changes that can affect future command resolution and make later path-hijacking issues easier.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The installer uses sudo to install system packages across multiple package managers, granting the script elevated privileges beyond the narrow task of setting up a user-space skill. If the repository or dependency chain is compromised, this privileged install path increases the blast radius and can alter the host system outside the skill's scope.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
A delete operation is documented as a normal command without any warning, dry-run option, or confirmation guidance. In an agent setting, destructive commands can be triggered by misunderstanding or prompt injection, leading to irreversible removal of tracked sources or associated state.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs automatic execution of `{skillDir}/install.sh` when the binary is missing, with no user-facing warning or consent gate. Auto-running installer scripts is a high-risk pattern because it can modify the system, fetch remote code, change PATH, or use elevated privileges before the user understands the scope of impact.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The script appends an export PATH line to shell profile files without explicit consent, so the change persists across sessions and may surprise the user. Silent persistence is risky because it modifies future shell behavior and can privilege a user-writable directory in command lookup.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
fi

  if require_cmd apt-get; then
    sudo apt-get update
    if [ "$ffmpeg_needed" -eq 1 ]; then
      sudo apt-get install -y git curl python3.12 python3.12-venv ffmpeg
    else
Confidence
90% confidence
Finding
sudo

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
if require_cmd apt-get; then
    sudo apt-get update
    if [ "$ffmpeg_needed" -eq 1 ]; then
      sudo apt-get install -y git curl python3.12 python3.12-venv ffmpeg
    else
      sudo apt-get install -y git curl python3.12 python3.12-venv
    fi
Confidence
91% confidence
Finding
sudo

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
if [ "$ffmpeg_needed" -eq 1 ]; then
      sudo apt-get install -y git curl python3.12 python3.12-venv ffmpeg
    else
      sudo apt-get install -y git curl python3.12 python3.12-venv
    fi
    if ! require_cmd "$PYTHON_BIN"; then
      echo "python3.12 not found after install. Please install Python 3.12 manually."
Confidence
91% confidence
Finding
sudo

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
if require_cmd dnf; then
    if [ "$ffmpeg_needed" -eq 1 ]; then
      sudo dnf install -y git curl python3.12 ffmpeg
    else
      sudo dnf install -y git curl python3.12
    fi
Confidence
90% confidence
Finding
sudo

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
if [ "$ffmpeg_needed" -eq 1 ]; then
      sudo dnf install -y git curl python3.12 ffmpeg
    else
      sudo dnf install -y git curl python3.12
    fi
    if ! require_cmd "$PYTHON_BIN"; then
      echo "python3.12 not found after install. Please install Python 3.12 manually."
Confidence
90% confidence
Finding
sudo

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
if require_cmd yum; then
    if [ "$ffmpeg_needed" -eq 1 ]; then
      sudo yum install -y git curl python3.12 ffmpeg
    else
      sudo yum install -y git curl python3.12
    fi
Confidence
89% confidence
Finding
sudo

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
if [ "$ffmpeg_needed" -eq 1 ]; then
      sudo yum install -y git curl python3.12 ffmpeg
    else
      sudo yum install -y git curl python3.12
    fi
    if ! require_cmd "$PYTHON_BIN"; then
      echo "python3.12 not found after install. Please install Python 3.12 manually."
Confidence
89% confidence
Finding
sudo

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
fi

  if require_cmd sudo; then
    sudo mkdir -p "$target_dir"
    sudo install -m 0755 "$tmpfile" "$target_path"
    rm -f "$tmpfile"
    LAUNCHER_PATH="$target_path"
Confidence
88% confidence
Finding
sudo

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
if require_cmd sudo; then
    sudo mkdir -p "$target_dir"
    sudo install -m 0755 "$tmpfile" "$target_path"
    rm -f "$tmpfile"
    LAUNCHER_PATH="$target_path"
    return
Confidence
88% confidence
Finding
sudo

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.