ClawHub

Dream LipSync

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward cloud lip-sync API skill, but users should understand that video and audio may be uploaded to third-party services.

Install only if you intend to use NewportAI/Dreamface for cloud lip-sync processing. Use a dedicated API key where possible, monitor usage or billing, and avoid uploading private, regulated, proprietary, or biometric media unless the provider's storage, retention, and regional handling are acceptable for your needs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation explicitly instructs users to upload local video/audio files to external OSS infrastructure before processing, but it does not clearly warn that potentially sensitive media will leave the local environment and be stored or processed by third-party services. This creates a real data-transmission and privacy risk, especially for personal, proprietary, or regulated media content.

External Transmission

Medium
Category
Data Exfiltration
Content
Upload your local files to OSS first (get upload policy, then upload).

```
POST https://api.newportai.com/api/file/v1/get_policy
```

**Request Body:**
Confidence
91% confidence
Finding
https://api.newportai.com/

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal