ClawHub
Back to skill

Security audit

gen-hot-video

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Flyelep video-generation API wrapper with expected third-party transmission and limited temporary-file handling.

Install only if you are comfortable sending the provided product video URL, reference video URL, prompts, task metadata, and Flyelep API key to Flyelep. Avoid using private or regulated media unless you accept third-party processing, and delete payload_temp.json after use if a temporary file is created.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill goes beyond describing an API and instructs the agent to use shell commands and local temporary files, expanding its operational scope unnecessarily. This broadens the attack surface by enabling file-system side effects and command execution patterns that can expose sensitive request contents, create cleanup failures, or be repurposed in unsafe contexts.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The documentation explicitly instructs writing request payloads containing user-supplied data to disk in a temporary file before transmission. Even if the secretKey is placed in headers, these payload files may contain sensitive user content and can persist on disk, be recovered from logs/backups, or remain after failed cleanup, creating avoidable local data exposure.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs sending user-provided video URLs and prompts to a third-party API but does not require an explicit user-facing disclosure that their media and metadata will be shared externally. In this context, the skill processes potentially sensitive creative assets, so omission of a privacy warning increases the risk of unintended data disclosure and uninformed consent.

External Transmission

Medium
Category
Data Exfiltration
Content
- **方式 B（无 Write 工具）**：使用 Shell 的 .NET API 创建文件（`Set-Content -Encoding UTF8` 会带 BOM，不可用）
- **macOS/Linux 环境**：
  - bash/zsh 默认使用 UTF-8 编码，可直接内联中文 JSON，无需临时文件。命令中使用 `curl`（无需 `.exe`，无需 `--%`）。
  - 推荐内联写法：`curl -X POST URL -H "..." -H "..." --data-binary 'JSON单行内容'`，一步完成。
  - 也可使用临时文件方式：`curl --data-binary @payload_temp.json`。
- **清理**：API 返回结果后，务必删除 `payload_temp.json` 临时文件（如使用了临时文件）。
Confidence
92% confidence
Finding
curl -X POST URL -H "..." -H "..." --data-binary 'JSON单行内容'`，一步完成。 - 也可使用临时文件方式：`curl --data-binary @payload_temp.json`。 - **清理**：API 返回结果后，务必删除 `payload_temp.json` 临时文件（如使用了临时文件）。 **示例 1：提交爆款视频复刻任

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.