Security audit

An OpenClaw skill for AI-powered multimedia generation (image, video, audio, 3D) via 170+ RunningHub API endpoints — zero dependencies, pure Python.

Security checks across malware telemetry and agentic risk

Overview

This skill is a broad but coherent RunningHub media-generation integration; its main risks are expected remote processing, file uploads, paid API use, voice cloning, and saved API-key handling.

Install only if you are comfortable sending prompts and media files to RunningHub and using a paid RunningHub API key. Use a dedicated revocable key, avoid sensitive or non-consensual media, and be especially careful with voice cloning because the skill does not add its own consent or anti-impersonation checks.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill declares no explicit permissions even though its documented behavior requires environment access, file read/write, and shell execution. This weakens security review and user consent because a caller may not realize the skill can execute local commands, access API keys, and write files, increasing the chance of misuse or unsafe deployment.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The capabilities inventory exposes much broader functionality than the skill description suggests, including generic text, image, and video understanding plus unrelated editing utilities. Scope expansion increases the chance that an invoking agent will route sensitive user data to unintended third-party services or use the skill as a general-purpose model gateway without appropriate policy review.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Voice cloning is a sensitive biometric-like capability with clear impersonation, fraud, and consent risks, and it is not justified by the stated purpose of general media generation and RunningHub app execution. Including it as a normal endpoint makes misuse materially easier, especially if callers are not forced through explicit consent and abuse controls.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Generic text-to-text endpoints turn the skill into a broad LLM access path beyond its declared media-generation role. That expanded authority can bypass least-privilege expectations, increase prompt/data exfiltration exposure, and make downstream policy enforcement harder because the skill now supports unconstrained text tasks.

Context-Inappropriate Capability

Medium

Confidence: 80% confidence
Finding: Image-to-text and video-to-text analysis endpoints expand the skill from generation into general content understanding, which changes the privacy and security posture. These endpoints can extract sensitive information from uploaded media and send it to external models without users expecting analytical processing from a generation-focused skill.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill is designed to send user prompts and uploaded media to the external RunningHub service, but it does not clearly disclose this data transfer or any privacy implications. Users may unknowingly submit sensitive images, audio, or text to a third party, creating confidentiality, retention, and compliance risks.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The manifest accepts uploaded images but provides no warning that those files may be transmitted to external model providers. This creates an informed-consent and privacy gap, especially because users may upload personal, copyrighted, or sensitive images believing processing is local or limited to the host platform.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill exposes video-upload endpoints without telling users that their videos may be transmitted to outside services. Because videos often contain faces, voices, locations, and other sensitive context, undisclosed transfer meaningfully increases privacy and compliance risk.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Uploading voice samples for cloning is highly sensitive, yet the manifest lacks any warning about impersonation, consent, or misuse risk. This is dangerous because voice data can be used to create convincing synthetic speech for fraud, social engineering, and non-consensual identity replication.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger conditions are broad enough that generic mentions of "workflow", "AI app", or similar terms could activate this skill even when the user did not intend to use RunningHub. In an agent environment, over-broad activation can cause the wrong toolchain to engage, leading to unintended external API calls, confusing user experiences, and accidental processing or upload of user-provided files to a third-party service.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs the agent to persist a user-provided API key into a local config file under the user's home directory without any warning, consent prompt, or discussion of storage security. Persisting credentials increases exposure to local compromise, accidental backup/sync leakage, or later reuse by unrelated processes, and the instructions normalize secret handling in a way that may exceed user expectations.

Vague Triggers

High

Confidence: 91% confidence
Finding: The instruction requires the skill to intercept essentially any image-generation request, creating an overly broad activation scope. In an agent environment, this can hijack user intent, override other safer or more appropriate skills, and cause unintended external API use or data transfer whenever users mention image generation.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: Forcing prompts to be rewritten in English without user opt-in can violate language-handling expectations and may alter meaning, especially for nuanced or culturally specific requests. This is primarily a policy and reliability risk rather than a direct exploit, but it can lead to unexpected processing of user content and degraded trust.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: Local media supplied by path is automatically converted to a data URI or uploaded to RunningHub, and large files are force-uploaded without an explicit confirmation at transmission time. In an agent setting, this can cause unintended exfiltration of sensitive local files if a prompt or tool invocation references private paths.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The script mutates downloaded files in place by rewriting the container header when it detects a QuickTime MOV signature. Silent in-place modification of remote content can violate user expectations, destroy forensic fidelity, and create integrity issues if downstream tooling assumes the file is unmodified from the source.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The skill explicitly tells the user to send their API key to the agent in plain language, creating an unnecessary secret-sharing flow through the conversational channel. Even if intended for setup convenience, this increases the chance of credential exposure through logs, transcripts, prompt history, screenshots, or downstream tooling that processes conversation content.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The documented workflow has the agent receive a user secret, validate it by invoking a script with the key on the command line, and then persist it to disk. This compounds multiple secret-handling risks: exposure in shell history or process listings, storage in plaintext configuration, and broader-than-necessary handling of credentials by the agent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.