ClawHub
Back to skill

Security audit

Video Translation

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it downloads a requested video, translates subtitles, uses TTS dubbing, and creates a dubbed video file.

Install only if you are comfortable reviewing and trusting the external downloader and TTS dependencies, providing a Noiz API key, and processing video/audio through the TTS backend. Use content and voices you have permission to translate or clone, and delete local media artifacts when they are sensitive or no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Low
Confidence
93% confidence
Finding
The workflow explicitly downloads a remote video and writes multiple artifacts to local storage, but the skill description and usage guidance do not warn users about those side effects. This can lead to unexpected local disk usage and persistence of potentially sensitive media files, which is a real transparency and safety issue even if it is not directly exploitable as code execution.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs users to translate subtitle content and send reference audio derived from the original video to an external TTS backend, but it does not disclose the privacy implications of transmitting spoken content and voice characteristics to third-party services. In this context, the omission is more serious because the workflow explicitly encourages voice cloning from the original speaker, which can expose biometric and sensitive content without informed consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal