ClawHub
Back to skill

Security audit

TencentCloud FaceID DetectAIFakeFaces

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-built for face anti-fraud checks, but it handles and uploads highly sensitive face media without enough clear user-facing disclosure or consent controls.

Review before installing. Use this only when you intentionally want face media sent to Tencent Cloud FaceID, have the subject's consent and legal basis to process biometric data, and are comfortable with the provider's retention and privacy terms. Avoid using it on unrelated images or videos, and prefer an updated version that requires explicit confirmation before upload.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
85% confidence
Finding
The trigger conditions are broad, including phrases like any scenario involving face anti-attack or anti-fraud detection, which may cause the skill to activate in contexts the user did not specifically intend. Because the skill processes highly sensitive biometric media, unintended invocation increases the risk of unnecessary handling and transmission of personal data.

Missing User Warnings

High
Confidence
97% confidence
Finding
The description discusses consent generally but does not clearly and prominently state that submitted face images, videos, or Base64-encoded biometric content will be transmitted to Tencent Cloud for processing. Since biometric data is highly sensitive, insufficient disclosure can lead to privacy violations, non-compliant data handling, and users unknowingly sending regulated personal information to a third party.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script transmits face images or videos to Tencent Cloud for analysis, which is an external transfer of highly sensitive biometric data. While this is the intended function of the skill, there is no explicit user-facing notice or consent step at the point of transmission, increasing privacy and compliance risk for unsuspecting users.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.