ClawHub
Back to skill

Security audit

Ecommerce Video Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed e-commerce video workflow that builds a video-generation payload and only submits it externally when the user runs the submit mode.

Use preview mode first for unreleased or sensitive product material. Only run `--submit` when you are comfortable sending the storyboard text, product reference image, and related payload details to the configured AIGC service, and review that service's privacy and retention terms before using real customer or proprietary assets.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly supports submitting generated video payloads to an external AIGC API, and the payload includes user-provided script content and product reference images encoded as URLs/data URIs. While submission is opt-in via `--submit`, the documentation does not clearly warn users what data leaves the local environment, which can lead to unintended disclosure of proprietary marketing scripts, product assets, or sensitive business information.

Static analysis

No suspicious patterns detected.