ClawHub
Back to skill

Security audit

Hailuo2

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward PoYo Hailuo 02 video-generation helper that sends user-provided prompts or image URLs to PoYo using the user's API key.

Install only if you intend to use PoYo's external API. Treat prompts, image URLs, callback URLs, and generated media as data sent to PoYo, and avoid submitting secrets, private images, regulated data, or sensitive business content unless that is intended under your PoYo account and policies.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill explicitly instructs use of `curl` and shell scripts (`scripts/submit_hailuo_02.sh`) but does not declare corresponding permissions. Undeclared execution capability reduces transparency and can cause the agent to invoke shell-based network operations without the user or platform having an accurate permission model.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill directs the agent to send prompts, images, and a bearer token to a third-party API but does not warn users that their content and authentication data leave the local environment. This can lead to unintentional disclosure of sensitive prompts or media, especially in image-to-video workflows where uploaded inputs may contain private data.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.