ClawHub

OpenFun

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent OpenFun CLI workflow for creating short videos, with disclosed login, installation, and token persistence risks.

Install only if you trust the openfun-cli npm package and OpenFun service. Treat ~/.openfun/config.json as sensitive, avoid printing or sharing it, and set clear limits for trend counts, remixes, renders, and downloads so automated runs do not use more credits than intended.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill description is overly broad and can match many generic requests about video creation, trend discovery, or automation, increasing the chance the agent invokes this skill in situations the user did not clearly intend. Over-broad routing is dangerous because it can trigger external tool use, account-linked actions, or content generation workflows without sufficiently precise user consent or scope.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation states that an authentication token persists in ~/.openfun/config.json but provides no warning about protecting, rotating, or removing that credential. Persistent local tokens increase the risk of credential theft, accidental leakage, or reuse by other processes on the same machine, especially in shared or multi-tenant agent environments.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal