ClawHub
Back to skill

Security audit

Audio Generation

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed CellCog audio-generation guide, but users should be careful with its cloned-voice feature.

Install only if you intend to use CellCog for audio generation and are comfortable providing a CellCog API key. Use cloned/avatar voices only for voices you own or have explicit permission to use, and avoid deceptive impersonation or fraud-like use cases.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly promotes cloned-voice/avatar voice generation but provides no consent, identity verification, or anti-impersonation guidance. In a voice-generation context, that omission materially increases the risk of misuse for fraud, social engineering, harassment, or unauthorized replication of a person's likeness, especially because the examples normalize use of 'my avatar' voices without any safety qualifiers.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.