ClawHub
Back to skill

Security audit

ClawVideo Generation

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward JSON2Video helper; its main risk is that video prompts, narration, and media URLs are sent to a third-party video API.

Install only if you are comfortable sending video prompts, narration text, overlays, image URLs, audio URLs, and related metadata to JSON2Video. Avoid using secrets, private internal URLs, confidential business assets, or personal data in configs, and be aware that the CLI prints part of the payload to stdout.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documentation instructs use of environment variables, local files, and outbound network access, but the skill declares no permissions or equivalent capability disclosure. This creates a trust and audit gap: users or platforms may invoke the skill without understanding that it can read configs, access secrets from the environment, and transmit data to an external service.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill sends user-provided prompts, image URLs, audio URLs, and rendered media instructions to the JSON2Video third-party API, but the description does not clearly warn users that their content leaves the local environment for external processing. This can cause unintended disclosure of sensitive marketing assets, unpublished media, or proprietary prompts to a third party.

VirusTotal

47/47 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.