ClawHub
Back to skill

Security audit

Video Enhancement

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward video-enhancement integration that sends user-selected video clips to verging.ai for processing, with no evidence of hidden execution, exfiltration, or destructive behavior.

Install only if you are comfortable sending the selected video, including local/private clips or videos downloaded from URLs, to verging.ai for processing. Use a scoped API key if available, avoid sensitive media unless the provider’s retention and sharing terms are acceptable, and clean /tmp/verging-video-enhancement/ yourself if the agent does not remove temporary files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill explicitly supports local files and remote URLs, and its execution flow uploads the processed video to verging.ai via a presigned URL, but the user-facing description does not clearly warn that supplied media will be transmitted to a third-party service. This can mislead users into providing sensitive or private videos under the assumption processing is local, creating a meaningful privacy and data-handling risk.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.