ClawHub
Back to skill

Security audit

AI Notes of Video

Security checks across malware telemetry and agentic risk

Overview

This skill is a narrow Baidu API helper for creating and querying AI notes from a user-provided video URL.

Install this only if you intend to use Baidu's service. Use a scoped Baidu API key where possible, avoid putting the key in shared logs or shell history, and do not submit private, internal, signed, authenticated, or sensitive video URLs unless you are authorized to share them with Baidu.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill asks users to provide a video URL for processing by Baidu but does not clearly disclose that the URL and referenced content are sent to an external third-party service. This can cause unintended data exposure, especially if users supply private, signed, internal, or otherwise sensitive video links.

Missing User Warnings

Low
Confidence
82% confidence
Finding
The setup requires BAIDU_API_KEY to be present in the runtime environment but does not warn that secrets will be exposed to the executing environment and potentially to subprocesses, logs, or misconfigured tooling. While common, failing to document this increases the risk of accidental credential leakage in shared or untrusted runtimes.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.