ClawHub
Back to skill

Security audit

Tellers

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Tellers video CLI integration, but users should be deliberate because it can upload private media, spend credits, and make previews public.

Install only if you trust Tellers and are comfortable using its CLI with an API key. Before running upload, generation, export, or public-preview commands, confirm which files will be uploaded, that credits may be spent, and whether a link should be public to anyone who has it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Third-Party CLI Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 15–18
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

bash
### 1. Install the CLI

```bash
brew tap tellers-ai/tellers && brew install tellers
text

### Technical Analysis

The Skill directs users to add an external Homebrew tap and install the current `tellers` package without pinning a reviewed version, referencing an immutable formula revision, or verifying the downloaded artifact's signature or checksum.

Because the external tap and its release artifacts can change after this Skill has been audited, the command may install code different from the code originally reviewed. A compromise of the tap repository, package publisher account, build pipeline, or hosted release artifact could turn this documented installation step into a supply-chain execution vector.

### Attack Path

1. An attacker compromises the external Homebrew tap, its maintainer account, release pipeline, or artifact hosting.
2. The attacker modifies the formula or referenced release artifact to distribute malicious code.
3. A user follows the Skill's installation command.
4. Homebrew retrieves and installs the attacker-controlled package because no immutable version or artifact integrity value is specified.
5. The malicious CLI executes with the user's privileges when installed or subsequently invoked by the Skill.
6. It may access data available to that user, including media selected for upload and the exported `TELLERS_API_KEY`.

### Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running Homebrew or the installed CLI. The resulting access is generally limited to that user's operating-system permissions, but it may include local files, uploaded media, shell environment variables, and the Tellers API credential. Theft of that credential could permit unauthorized API activity
...[truncated 245 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the CLI to an explicitly reviewed version rather than installing the latest available release.
  • Reference an immutable Homebrew formula revision or otherwise lock the package source to a specific commit.
  • Verify release signatures or cryptographic checksums before installation, obtaining expected values through a trusted channel.
  • Document the exact reviewed source and binary versions.
  • Prevent unattended upgrades during Skill execution and require a separate review before changing the pinned version.
  • Prefer a trusted package source with provenance attestations and reproducible builds where available.
  • Run the CLI with least privilege and avoid exposing unrelated files or environment variables.
  • Store TELLERS_API_KEY in an operating-system credential manager or narrowly scoped secret store, and use a restricted API key where supported.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: tellers
description: "Create, edit, and share AI-generated videos using tellers.ai — an AI video platform that aggregates leading generation models (Kling, Veo, LTX, ElevenLabs, and more) for video, image, and music. Use when a user wants to upload and edit real or user footage, generate videos from scratch using stock footage or AI models, add overlays, subtitles, music, or effects, create news summaries, highlight reels, promos, or custom client videos, share or export a finished video. Also handles uploading media, checking processing status, making assets public, and any tellers CLI operation. Triggers on phrases like 'create a video', 'make a highlight reel', 'upload footage to tellers', 'generate a summary video', 'create an edit', 'add subtitles', 'use stock footage', 'share a video preview', 'export video', 'tellers'."
---

# Tellers Skill

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill advertises very broad trigger phrases such as 'create a video', 'export video', and even 'tellers', which can cause unintended activation in contexts where the user did not explicitly intend to use this third-party service. Because the skill can upload media, spend credits, and change sharing state, accidental invocation could lead to unwanted external actions and data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The public-sharing workflow instructs the agent to make assets or projects anonymously readable and generate a shareable preview URL, but it does not require a clear warning or explicit user confirmation about the privacy consequence. In a skill handling user footage and client videos, this creates a real risk of unintentionally exposing sensitive or private media to anyone with the link.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.