ClawHub
Back to skill

Security audit

Ai Agentic Video Editor

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed cloud video-editing skill that sends prompts and media/project data to a remote editing API, which fits its stated purpose but requires user care with sensitive content.

Install only if you are comfortable sending video prompts, project or scene data, asset URLs, and related media metadata to the Levea/Livecore service. Use plan approval for risky or destructive edits, preview all exports before publishing, and treat auto-export or approval prompts as real actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The invocation guidance is extremely broad and encourages routing a wide range of generic video-editing requests into this skill, even when users may not have explicitly consented to sending media, prompts, or project context to a third-party API. In an agent setting, over-broad matching increases the chance of unintended activation and silent data transfer to an external service, especially because this skill performs mutating edits and auto-export behavior.

External Transmission

Medium
Category
Data Exfiltration
Content
Every edit goes through one tool — `autonomous_edit`. Pass a natural-language description; the agent plans, executes, verifies, and exports. No tool list to memorize, no structured params to learn.

```bash
curl -sS -X POST "$LEVEA_API_URL/api/v1/misc/openclaw/v1/execute" \
  -H "Authorization: Bearer $LEVEA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
93% confidence
Finding
curl -sS -X POST "$LEVEA_API_URL/api/v1/misc/openclaw/v1/execute" \ -H "Authorization: Bearer $LEVEA_API_KEY" \ -H "Content-Type: application/json" \ -d

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.