ClawHub
Back to skill

Security audit

AI 短视频工厂

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent video-production helper, but it asks agents to run mutable package commands, download browser components, disable sandboxing for renders, and use a sudo troubleshooting command without enough containment guidance.

Install only if you are comfortable running a video-rendering toolchain with shell access. Prefer pinning HyperFrames and Python package versions, running renders in a disposable container or VM, avoiding dangerouslyDisableSandbox unless isolated, and not using the sudo chown workaround without diagnosing the exact permission problem.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:68
Finding

Mutable Third-Party CLI Is Downloaded and Executed Through npx

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:833
Finding

Unpinned Python Packages Are Installed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:118
Finding

Skill Mandates Disabling the Browser Execution Sandbox

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:119
Finding

Troubleshooting Guidance Performs Privileged Recursive Ownership Changes

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (91)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description centers on creating MP4 videos from HTML with HyperFrames, including visual editing/animation and muxing as part of a video pipeline. The actual code chunk does not render HTML, generate video, create MP4 files, or perform visual composition. Instead, it synthesizes deterministic ambient background music and saves it as a WAV file. While audio can be related to a video workflow, this code's primary purpose is materially different and represents an undeclared capability focused on standalone audio generation rather than short-video creation.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 529)May include surrounding context.

md
<body>
  <div data-composition-id="main" data-start="0" data-width="1920" data-height="1080">

    <!-- Video clip: track 0, starts at 0s, plays for 10s -->
    <video id="bg-video" data-start="0" data-duration="10" data-track-index="0"
           src="background.mp4" muted playsinline></video>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1136)May include surrounding context.

md
data-width="1920" data-height="1080" data-fps="30"
       data-duration="VIDEO_DURATION">

    <!-- Track 0: 原始视频（或去背景后的视频 + 新背景） -->
    <video id="main-video"
           data-start="0" data-duration="VIDEO_DURATION" data-track-index="0"
           src="input.mp4"

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1136)May include surrounding context.

md
data-width="1920" data-height="1080" data-fps="30"
       data-duration="VIDEO_DURATION">

    <!-- Track 0: 原始视频(或去背景后的视频 + 新背景) -->
    <video id="main-video"
           data-start="0" data-duration="VIDEO_DURATION" data-track-index="0"
           src="input.mp4"

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1194)May include surrounding context.

md
<!-- Track 0: 新背景 -->
<div id="new-bg" data-start="0" data-duration="VIDEO_DURATION" data-track-index="0"
     style="position:absolute;inset:0;background:linear-gradient(135deg, #1a1a2e 0%, #16213e 50%, #0f3460 100%);">
  <!-- 可放动态网格、粒子等背景动画 -->
</div>

<!-- Track 1: 去背景后的人物 -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1526)May include surrounding context.

For complex videos, split into separate HTML files:

html
<!-- In index.html -->
<div id="scene-1" data-composition-id="intro"
     data-composition-src="compositions/intro.html"
     data-start="0" data-duration="5" data-track-index="1"></div>

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to run npx hyperframes browser ensure without pinning an exact package version, which causes execution of whatever package version is current at install time. If the upstream package, dependency chain, or account is compromised, users may execute attacker-controlled code on their machine during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The invocation example is extremely broad natural language and maps to a high-capability workflow that can initialize projects, generate files, and render media. Without explicit activation constraints or confirmation gates, users may trigger substantial local actions unintentionally or the agent may over-assume permission to perform resource-intensive operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README advertises fully automatic initialization, rendering, audio handling, and delivery, but does not warn users that these actions may create/modify local files, download dependencies, consume CPU/GPU/storage, or process media inputs. In an agentic environment, missing disclosure increases the chance of unsafe or unexpected execution on user systems.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill exposes clear shell and network-capable workflows (npx, ffmpeg, browser downloads) but does not declare any explicit tool scope or allowed-tools boundary. In an agent environment, this increases the blast radius because the skill can induce package downloads, command execution, and external fetches without a least-privilege contract.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

Using npx hyperframes without a pinned version allows the resolved package to change over time or be influenced by registry/package compromise. In a skill that repeatedly instructs shell execution, this creates a supply-chain execution path where different code can run than what the author reviewed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

This unpinned npx hyperframes invocation enables execution of whatever version is current at runtime, rather than a reviewed artifact. Because the skill is operational documentation for agents, that translates directly into a mutable remote-code execution surface.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

An unpinned package execution command means a future or malicious package release could alter behavior or introduce harmful install scripts. The context is especially risky because the skill normalizes repeated command execution by an automated agent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

This command relies on mutable package resolution from the registry, which is a classic supply-chain risk. In a skill that may run unattended, the lack of version pinning removes reproducibility and weakens trust boundaries.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

Unpinned npx execution at setup time can fetch and run unexpected code, including postinstall behavior, if the package or dependency tree changes. This is a meaningful supply-chain issue, not just a documentation quality problem.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

Because the skill instructs agents to run npx hyperframes directly, an unpinned reference can silently drift to unreviewed code. The impact is elevated by the skill's frequent shell usage and the presence of browser and media tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

This instance has the same supply-chain execution risk as the other floating npx references: the actual code executed depends on the registry state at runtime. In automated environments, that can become an easy path to compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

An unpinned npx call in prerequisite validation still causes code resolution from the network and can execute unreviewed package code. Since the command is framed as mandatory, the skill encourages unsafe default behavior at scale.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

This package execution reference is mutable and therefore vulnerable to dependency or package takeover scenarios. The risk is heightened because it is part of a first-time setup flow that agents are likely to execute automatically.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The reference to npx cache appears to stem from prose about the npx cache rather than a real executable command. As flagged, this is likely a parser artifact and not an exploitable package-execution path by itself.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
95% confidence
Finding

The document directly recommends a sudo command to modify npm cache ownership, introducing privileged execution into a routine troubleshooting path. In agent or semi-automated environments, normalizing root-level fixes can lead to unnecessary privilege use and broader damage if combined with other mistakes or malicious package behavior.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
| `doctor` shows ✗ FFmpeg | FFmpeg not installed | `brew install ffmpeg` |
| `doctor` shows ✗ Chrome | First run, no cached browser | `npx hyperframes browser ensure` |
| Render hangs indefinitely | Chrome sandbox conflict in WorkBuddy | Use `dangerouslyDisableSandbox: true` on Bash tool |
| `EACCES` permission error | npx cache permission issue | `sudo chown -R $(whoami) ~/.npm` |
| Render produces 0-byte MP4 | FFmpeg encoder issue | Check `ffmpeg -encoders` has `libx264` and `aac` |
| `npx hyperframes` not found | Node/npx not in PATH | 确保 Node.js 22+ 在 PATH 中；WorkBuddy 环境下使用托管 Node |

Static analysis

No suspicious patterns detected.