ClawHub
Back to skill

Security audit

Article to Short

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says: send an article URL to Revid to create a short video, with the main consideration being third-party sharing of the URL and article content.

Install only if you are comfortable using Revid as a third-party processor for article URLs and generated video content. Avoid private, internal, authenticated, sensitive, or paywalled URLs unless you have permission and have reviewed Revid's privacy and retention terms.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill sends a user-supplied article URL to a third-party service along with an API key, but it does not warn the user that their provided link and potentially derived article content will be shared externally. This creates a privacy and data-handling risk, especially if users provide internal, paywalled, sensitive, or personally identifying URLs under the assumption processing is local.

Static analysis

No suspicious patterns detected.