ClawHub

Douyin Video Transcriber

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Douyin video transcription tool whose network, token, ffmpeg, and file-writing behavior matches its stated purpose.

Install only if you are comfortable providing a TikHub API token and running ffmpeg/Whisper locally. Keep the token out of source control and logs, verify the publisher/source because the repository URL is a placeholder, and be careful with --output-file because it can overwrite files the user account can write.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation declares operational requirements and usage that imply environment access, local file read/write, network access, and shell execution, but it does not explicitly declare corresponding permissions. This can undermine sandboxing and user consent because the agent may perform sensitive actions beyond what the manifest transparently communicates.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation instructs users to place a TikHub API token in a local config file but does not warn that the token is sensitive, should be protected with restrictive file permissions, and must not be committed or logged. In a skill that also performs file and shell operations, poor credential handling increases the chance of accidental disclosure through reports, debugging output, backups, or repository sync.

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal