ClawHub
Back to skill

Security audit

Ppt To Video

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a PPT-to-video helper, but it can automatically change the Windows registry and install Python packages without a clear opt-in or rollback path.

Install only if you are comfortable with a skill that may modify PowerPoint registry settings on Windows and install Python packages during use. Prefer running it in a controlled environment, review any generated commands before execution, and ask the agent to avoid registry edits or package installs unless you explicitly approve them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The skill instructs modifying the Windows registry to change PowerPoint export DPI, which is a persistent system configuration change unrelated to the minimum necessary actions for a one-time PPT-to-video conversion. This can alter host behavior beyond the task, requires elevated trust, and is performed without explicit user consent or rollback guidance.

Context-Inappropriate Capability

Low
Confidence
88% confidence
Finding
The skill directs automatic package installation (`pip install`) during execution, which changes the runtime environment and can introduce unreviewed dependencies. Even if intended for convenience, environment modification expands the skill's capability beyond file conversion and can create supply-chain and stability risks.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill omits a prominent warning that it may modify the Windows registry to adjust PowerPoint export resolution. Because registry edits are persistent and sensitive, failing to disclose them clearly prevents informed consent and increases the chance of unintended system changes.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.