Skill Trust Decision
product-demo-video
Legitimate product demo video creator with documented risks; shell command injection concern via unsanitized narration is acknowledged but no malicious chain exists.
Why this conclusion was reached
1/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Block
Hidden execution and egress
1 high-risk artifacts or egress signals were extracted.
Pass
Attack chain and severe findings
There is no explicit malicious chain in the report.
Review
Dependencies and supply chain hygiene
3 dependency or supply-chain issues need attention.
What drove the risk score up
Shell command injection risk +15
Narration text is interpolated into execSync shell commands without sanitization. skill-card.md partially acknowledges this.
Remote binary download +5
Downloads FFmpeg static binary from johnvansickle.com without integrity verification (no checksum).
Global package installs +5
install-deps.sh uses npm i -g and pip install globally, making broad system changes.
Most important evidence
Medium RCE
Shell command injection via unsanitized narration
The narration text from SCENES array is interpolated directly into edge-tts shell commands without sanitization. A malicious user-provided narration could break out of the shell command.
scripts/record-demo.mjs:112 Escape or validate narration input. Pass arguments as an array to execSync() instead of template strings, or sanitize special shell characters.
Medium Supply Chain
Remote binary download without integrity check
FFmpeg static binary is downloaded from johnvansickle.com without a checksum or signature verification. This could be replaced by a man-in-the-middle attack.
scripts/install-deps.sh:19 Verify the downloaded binary with a SHA256 checksum, or prefer package-manager installation which provides signature verification.
Low Supply Chain
Unpinned package versions
Dependencies are installed without version pinning (npm i -g puppeteer, pip3 install edge-tts Pillow). This can lead to supply chain attacks via dependency confusion or typosquatting.
scripts/install-deps.sh:6-11 Pin all dependency versions (e.g., [email protected], edge-tts==6.1.10) to prevent unexpected updates.
Info Doc Mismatch
Shell execution partially undeclared in SKILL.md
SKILL.md describes the tool stack but does not explicitly declare that arbitrary shell commands are executed via Node.js execSync. The skill-card.md does acknowledge 'shell command construction during demo generation' as a known risk.
SKILL.md:1 Add an explicit section in SKILL.md explaining that shell commands are constructed and executed to invoke FFmpeg, edge-tts, and Python overlay scripts.
Declared capability vs actual capability
Shell Pass
Declared WRITE
→ Inferred WRITE
SKILL.md documents subprocess usage for FFmpeg, edge-tts Filesystem Pass
Declared WRITE
→ Inferred WRITE
record-demo.mjs:47 — fs.mkdirSync, fs.writeFileSync Network Pass
Declared READ
→ Inferred READ
record-demo.mjs:56 — page.goto(s.url) for browser recording Browser Pass
Declared WRITE
→ Inferred WRITE
record-demo.mjs:107 — puppeteer.launch + screenshot Environment Pass
Declared NONE
→ Inferred READ
child_process execSync inherits env; no explicit env harvesting credential_access Pass
Declared NONE
→ Inferred NONE
No credential harvesting observed Suspicious artifacts and egress
Critical Dangerous Command
rm -rf / scripts/install-deps.sh:23
Medium External URL
https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz scripts/install-deps.sh:19
Medium External URL
https://yourapp.dev/ scripts/record-demo.mjs:56
Medium External URL
https://yourapp.dev/feature1/ scripts/record-demo.mjs:67
Medium External URL
https://clawhub.ai/user/xiazai77 skill-card.md:7
Medium External URL
https://clawhub.ai/xiazai77/product-demo-video skill-card.md:30
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| puppeteer | * | npm | No | Version not pinned; global install |
| edge-tts | * | pip | No | Version not pinned; calls Microsoft servers |
| Pillow | * | pip | No | Version not pinned |
| ffmpeg | static | remote_download | No | Downloaded from johnvansickle.com without integrity verification |
File composition
6 files · 643 lines
JavaScript 1 files · 303 linesMarkdown 3 files · 285 linesShell 1 files · 50 linesJSON 1 files · 5 lines
Files of concern · 4
scripts/record-demo.mjs Shell command injection via unsanitized narration · https://yourapp.dev/ · https://yourapp.dev/feature1/
SKILL.md Shell execution partially undeclared in SKILL.md
skill-card.md https://clawhub.ai/user/xiazai77 · https://clawhub.ai/xiazai77/product-demo-video
scripts/install-deps.sh Remote binary download without integrity check · Unpinned package versions · rm -rf / · https://johnvansickle.com/ffmpeg/releases/ffmpeg-release-amd64-static.tar.xz
Other files · demo-planning.md · _meta.json
Security positives
No credential harvesting, API key theft, or environment variable exfiltration observed
No base64-encoded payloads, obfuscated code, or anti-analysis techniques detected
No reverse shell, C2 communication, or data exfiltration endpoints found
skill-card.md acknowledges dependency installation and shell command injection risks
No hidden persistence mechanisms (cron, startup hooks, backdoor installation) detected
Functionality is coherent and matches the stated purpose: product demo video generation