ClawHub

Mediakit Voiceover

Security checks across malware telemetry and agentic risk

Overview

This is a cloud media voiceover skill that is broadly coherent with its purpose, but users should expect NemoVideo API calls, token use, and uploads of selected media assets.

Install only if you are comfortable sending selected media-kit files, URLs, prompts, and generated project state to NemoVideo cloud services. Use a limited or dedicated NEMO_TOKEN where possible, and ask the agent to confirm before creating a session, uploading files, or exporting if you want tighter control.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The activation examples are broad enough that ordinary user language could invoke the skill unintentionally, especially because the skill invites users to 'just tell me what you're thinking.' In a skill that automatically connects to an external API and may begin cloud processing setup, accidental invocation can lead to unintended data transfer or token/session creation without clear user intent.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The routing table maps highly generic terms like 'export,' 'upload,' and 'status' directly to actions without requiring context that the user is operating on this skill's media session. That increases the chance of the skill hijacking unrelated user requests and triggering uploads, state queries, or exports against a cloud backend unexpectedly.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs the agent to connect to third-party endpoints, create tokens, and upload user media and prompts to a remote cloud rendering service, but it does not present a clear upfront warning or consent notice to the user. Because the assets may include sensitive marketing materials, brand documents, or unpublished media, silent transmission to an external service creates privacy, confidentiality, and compliance risk.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal