ClawHub
Back to skill

Security audit

AI Notes Video

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says: it sends a user-provided video URL to Baidu to generate AI notes, with no evidence of hidden persistence, unrelated data access, or destructive behavior.

Install only if you are comfortable sending the provided video URL and related task metadata to Baidu's service using your BAIDU_API_KEY. Avoid confidential, internal-only, signed, token-bearing, or proprietary media URLs unless you are authorized and understand Baidu's processing and retention terms.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill sends a user-supplied video URL and associated task data to Baidu's external API, but the description does not clearly warn users about this third-party data transfer. This can cause unintended disclosure of sensitive internal URLs, signed URLs, or proprietary media locations, especially because the skill is explicitly driven by arbitrary user-provided video addresses.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.