ClawHub
Back to skill

Security audit

UGC Factory

Security checks for vulnerabilities and agentic risk

Overview

UGC Factory is a coherent paid content-generation API, but it needs Review because it can autonomously publish or schedule social content, spend funds, store media, and remove watermarks without clear safeguards.

Install only if you are comfortable connecting an agent to a paid remote service that may create, schedule, and publish social content. Use wallet spending limits, require manual approval before posting, avoid confidential media unless retention terms are clear, and only use YouTube fetching or watermark removal for content you are authorized to process.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly enables autonomous content generation and publishing workflows, but the description does not warn users that an agent may schedule or post content without human review. This creates a meaningful risk of accidental publication of harmful, noncompliant, or brand-damaging content because the autonomous nature of the capability is under-disclosed.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill advertises uploading media, fetching assets, and using multiple external services, but it does not clearly disclose that user content and metadata may be transmitted to third-party providers. Without this warning, users may unintentionally expose sensitive, proprietary, or regulated media to external systems during analysis, generation, or storage.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
Endpoints for fetching from YouTube and stripping watermarks are rights-sensitive operations that can facilitate copyright infringement, terms-of-service violations, or misuse of protected content if presented without cautionary guidance. In this context, the combination of media acquisition, automation, and watermark removal increases the likelihood of abuse beyond a neutral media-processing tool.

Static analysis

No suspicious patterns detected.