ClawHub
Back to skill

Security audit

Kling Video

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward documentation-only skill for using AceDataCloud's Kling video API, with expected third-party API use and token authentication.

Install only if you intend to use AceDataCloud/Kling and are comfortable sending prompts, media URLs, task data, and any callback URL to that provider. Keep ACEDATACLOUD_API_TOKEN in a protected environment or secrets manager, avoid committing or sharing it, and avoid submitting sensitive, regulated, private, or internal-only URLs unless your organization has approved the provider.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly sends prompts, image URLs, video URLs, and potentially callback URLs to a third-party API, but it does not disclose the privacy or data-sharing implications. This can lead users to unknowingly transmit sensitive content or internal URLs to an external service, creating confidentiality and data governance risk.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The authentication section instructs users to export an API token but gives no guidance on secure credential handling. Users may place tokens in shell history, logs, screenshots, shared terminals, or insecure environments, increasing the chance of accidental credential exposure.

Static analysis

No suspicious patterns detected.