ClawHub
Back to skill

Security audit

Tweet to Talking-Head

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it uses Revid to turn user-provided post text or a post URL plus an avatar into a talking-head video.

Install only if you are comfortable sending the post content or URL, avatar image URL or character ID, and your Revid API key to Revid. Prefer pasted text over URL scraping when possible, avoid private or sensitive material, and use avatar images with proper rights and consent.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill encourages users to submit pasted thread text and post URLs to a third-party service without clearly disclosing that this content leaves the local environment for external processing. Users may unknowingly transmit private, sensitive, or copyrighted material, creating privacy, compliance, and consent risks.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
Avatar images are likely uploaded to the external video-generation service, and these images may contain biometric or identity-related data. Failing to warn users about external transmission of face images increases privacy and consent risk, especially if images depict real people or are used without authorization.

Static analysis

No suspicious patterns detected.