ClawHub
Back to skill

Security audit

Aliyun Pixverse Generation

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Alibaba Cloud PixVerse video-generation helper with expected cloud API use, but users should notice the naming mismatch and third-party data handling.

Install this only if you intend to use Alibaba Cloud DashScope for PixVerse video generation. Use a scoped API key where possible, avoid submitting secrets or confidential media unless approved for that provider, and be aware that generated request files may contain sensitive prompts or media URLs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest names the skill 'Alibaba Cloud AI Video Aishi Generation' while the metadata and description clearly indicate a PixVerse video generation skill. This inconsistency can mislead users or orchestration systems into invoking the wrong capability, increasing the risk of confused-deputy behavior, misrouting, or unsafe assumptions about what model or workflow is being used.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly instructs sending prompts, media URLs, and generation requests to Alibaba Cloud DashScope endpoints, but it does not provide an explicit user-facing warning that potentially sensitive text and media will leave the local environment and be processed by a third party. This creates a real privacy and data-governance risk, especially if users include confidential prompts, internal images, or regulated data.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.