ClawHub
Back to skill

Security audit

Podcast Downloader

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its script can let podcast metadata control output paths and potentially overwrite files outside the intended folder.

Review before installing. Use a non-synced output directory, keep backups, and avoid running this on untrusted episode URLs until file-name sanitization and output-directory containment are added.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/download.sh:72
Finding

Path Traversal and Arbitrary File Overwrite Through Untrusted Episode Metadata

Content
View full analysis
&1 | tail -1 # Check if conversion succeeded if [ ! -f "$MP3_FILE" ]; then echo -e "${RED}Error: Conversion failed${NC}" exit 4 fi # Delete m4a (unless KEEP_M4A=true) if [ "$KEEP_M4A" != "true" ]; then echo "Deleting m4a..." rm "$M4A_FILE" fi # Save show notes as markdown echo "Saving show notes..." echo "$INFO" | jq -r '.props.pageProps.episode.shownotes' > "$NOTES_FILE" ``` ### Technical Analysis The podcast name and episode title are obtained from remotely supplied Xiaoyuzhou metadata and used directly as directory and file-name components. The script does not reject path separators, `..` traversal components, control characters, or other unsafe file-name content. Shell quoting prevents word splitting and command substitution, but it does not prevent filesys ...[truncated 2187 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code largely matches the core declared purpose: it downloads a Xiaoyuzhou podcast episode, converts the audio to MP3, supports configurable audio quality, and saves show notes as Markdown. However, there are material discrepancies. First, the description explicitly claims support for batch download, but the script only accepts a single episode URL and contains no batch-processing logic. Second, the description states that audio is saved to a Baidu Cloud sync directory, but the implementation merely writes to a configurable local directory with a default path under /Users/zym/Documents/podcast; there is no Baidu Cloud-specific integration or validation. No unrelated or clearly undeclared sensitive capabilities are present.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill advertises executable shell usage (./scripts/download.sh, curl, jq, ffmpeg) but does not declare any tool scope such as permissions or allowed-tools. That omission weakens review and containment because an agent may invoke shell capabilities without an explicit, user-visible declaration of what execution is required.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says the skill should be used '当用户需要下载播客、保存播客音频、提取播客文字内容时使用' without defining specific trigger phrases, scope limits, or exclusion conditions. These are broad everyday intents rather than narrowly scoped invocations, which increases the chance of unintended activation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill states that output is written to a Baidu cloud sync directory and that original m4a files are deleted, but it does not present these as prominent user warnings. This can lead to unintended data synchronization to a third-party cloud folder and irreversible file deletion, increasing privacy and data-loss risk in the context of a downloader that processes local files automatically.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference.md (reported line 133)May include surrounding context.

brew install ffmpeg

Ubuntu/Debian

sudo apt install ffmpeg

text

### jq not found

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference.md (reported line 145)May include surrounding context.

brew install ffmpeg

Ubuntu/Debian

sudo apt install ffmpeg

text

### jq not found

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file applies to SQP-2, and it states that m4a files are deleted by default after processing. Deleting downloaded source files is a potentially irreversible operation affecting user data, but the reference does not present it as a clear warning or caution before users run the workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.