ClawHub
Back to skill

Security audit

generate-video

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Flyelep video-generation API helper that discloses the data and API key it sends to the service.

Install only if you are comfortable sending your video prompt, referenced media URLs, and Flyelep API key to Flyelep. Provide the key at runtime, avoid placing it in saved files or logs, and remove any temporary payload file after use as the skill instructs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
- **方式 B（无 Write 工具）**：使用 Shell 的 .NET API 创建文件（`Set-Content -Encoding UTF8` 会带 BOM，不可用）
- **macOS/Linux 环境**：
  - bash/zsh 默认使用 UTF-8 编码，可直接内联中文 JSON，无需临时文件。命令中使用 `curl`（无需 `.exe`，无需 `--%`）。
  - 推荐内联写法：`curl -X POST URL -H "..." -H "..." --data-binary 'JSON单行内容'`，一步完成。
  - 也可使用临时文件方式：`curl --data-binary @payload_temp.json`。
- **清理**：API 返回结果后，务必删除 `payload_temp.json` 临时文件（如使用了临时文件）。
Confidence
86% confidence
Finding
curl -X POST URL -H "..." -H "..." --data-binary 'JSON单行内容'`，一步完成。 - 也可使用临时文件方式：`curl --data-binary @payload_temp.json`。 - **清理**：API 返回结果后，务必删除 `payload_temp.json` 临时文件（如使用了临时文件）。 **示例 1：提交视频生成任务（

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.