ClawHub
Back to skill

Security audit

video-to-screenplay

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims: it turns user-supplied audio, video, or transcript files into screenplay outputs using configured LLM providers.

Install only if you are comfortable sending transcript-derived content to the selected LLM provider configured in OpenClaw. Avoid using private, regulated, or confidential recordings unless you have reviewed the provider's data handling terms or redacted sensitive content first.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill documentation describes capabilities that read local files, write output files, and send content to external LLM providers, but it does not declare corresponding permissions. This creates a transparency and consent problem: users or orchestrators may invoke the skill without realizing it accesses local data and transmits transcript content over the network.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill requires an external LLM API key and processes transcripts into story DNA and screenplay output, which strongly implies user-provided transcript content may be sent to third-party providers. Omitting this warning is dangerous because transcripts and audio-derived text can contain sensitive personal, business, or regulated information, and users are not clearly informed before data leaves the local environment.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill sends transcript content, which may contain sensitive audio or video-derived personal or business information, to third-party LLM APIs without any explicit warning, consent prompt, or data-handling notice. In this context, users may reasonably assume a local media-processing workflow, so silent exfiltration to external providers creates a meaningful privacy and confidentiality risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.