ClawHub
Back to skill

Security audit

infinimo-ai-design-product-video-create

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Infinimo product-video helper skill that sends chosen images and prompts to an external service, with no evidence of hidden persistence or deceptive behavior.

Install only if you intend to use Infinimo/clawec as a third-party processing service. Use a scoped API key, review each file path before running upload_image.sh, and avoid confidential, regulated, customer-sensitive, or unreleased product assets unless you have approval for external processing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs users to run local shell scripts (for example, `bash scripts/*.sh`) but does not declare corresponding permissions or clearly surface that executable shell capability is required. This creates a transparency and trust problem: users may invoke shell-based actions that handle tokens, upload files, and contact external APIs without having been warned through the skill's permission model.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill directs users to upload product images and submit prompts/scripts to an external service, but it does not include a clear privacy or data-handling warning. Because uploaded images may contain proprietary product assets and prompts may include sensitive marketing or business information, users could unknowingly transmit confidential data to a third party.

Static analysis

No suspicious patterns detected.