ClawHub
Back to skill

Security audit

Influencer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a virtual-influencer playbook with compliance guidance, but it also includes detection-avoidance advice and under-scoped voice and face cloning workflows.

Install only if you are prepared to enforce your own safeguards: use fully fictional or licensed personas, obtain documented consent for any voice or likeness, avoid face-swapping real people, keep voice IDs and source audio private, and remove or ignore the detection-avoidance guidance in favor of visible AI and sponsorship disclosures.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
image-gen.md:119
Finding

Instructions Encourage Evasion of AI-Generated Content Detection

Content
View full analysis

Vulnerability Details

File Location: image-gen.md:119-126 and video-gen.md:145-151
Vulnerability Type: Deceptive synthetic-media evasion
Risk Level: Medium

Complete Vulnerable Snippets:

image-gen.md:119-126

markdown
## Avoiding Detection

AI-generated images can be detected. Reduce risk:

1. **Add subtle imperfections** (not too perfect)
2. **Vary lighting** (not always studio perfect)
3. **Use realistic settings** (avoid fantasy/impossible)
4. **Post-process slightly** (minor adjustments in Lightroom)
5. **Mix with real elements** (real backgrounds when possible)

video-gen.md:145-151

markdown
## Avoiding Detection

1. **Vary content types** — don't only post AI talking heads
2. **Add real footage** — b-roll of hands, products, environments
3. **Imperfect audio** — slight room tone, not too clean
4. **Natural mistakes** — small pauses, filler words in script
5. **Behind the scenes** — generated "candid" content

Technical Analysis

These sections explicitly frame realism-enhancing techniques as methods for “Avoiding Detection.” Adding deliberate imperfections, real footage, room tone, artificial mistakes, and generated candid material can make synthetic personas more difficult for audiences or moderation systems to recognize as AI-generated.

Although other project files recommend disclosure, these instructions undermine that safeguard by teaching users how to reduce detectable indicators of synthetic media. Improving visual or audio quality is legitimate, but tying those changes to detection avoidance creates a deceptive-use workflow rather than a neutral content-quality workflow.

Attack Path

  1. A user creates an AI-generated persona and produces synthetic images or video.
  2. The user follows the documented instructions to add imperfections, realistic backgrounds, real footage, room tone, filler words, and generated candid content.
  3. These elements ...[truncated 886 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the “Avoiding Detection” framing and replace it with a neutral “Quality and Authenticity Controls” section.
  2. Explicitly prohibit using realism enhancements to conceal that content is AI-generated.
  3. Require visible AI disclosure in the media itself and in the accompanying caption or description.
  4. Require disclosure to remain intact when content is repurposed across platforms.
  5. Replace generated “candid” or behind-the-scenes narratives with clearly labeled fictional or synthetic material.
  6. Add a pre-publication control verifying that disclosure remains visible after editing, cropping, transcoding, and scheduling.
  7. Align these files with the disclosure requirements already documented in compliance.md.

T09 · Insecure Skill Coding Practices

Error
Location
voice.md:5
Finding

Voice-Cloning Workflow Does Not Require Verified Speaker Consent

Content
View full analysis

Vulnerability Details

File Location: voice.md:5-12 and video-gen.md:118-122
Vulnerability Type: Missing authorization and consent validation for biometric voice cloning
Risk Level: High

Complete Vulnerable Snippets:

voice.md:5-12

markdown
### ElevenLabs (Recommended)
1. **Record source audio** (1-5 min of clean speech)
   - Match target persona's tone/energy
   - Clear recording, no background noise
   - Various emotional tones for range
2. **Create voice clone** in ElevenLabs dashboard
3. **Test with sample scripts** before production
4. **Save voice_id** in persona's `tools.md`

video-gen.md:118-122

markdown
### Voice Cloning (ElevenLabs)
1. Record 1-3 min of clean audio (any voice that fits persona)
2. Upload to ElevenLabs for cloning
3. Use cloned voice for all content
4. Save voice_id in tools.md

Technical Analysis

The operative workflow directs users to record or obtain source audio and upload it to a third-party voice-cloning provider. The phrase “any voice that fits persona” does not restrict the source to the user’s own voice, a licensed synthetic voice, or a speaker who has explicitly consented.

Voice recordings can function as biometric identifiers. Cloning them without verified authorization can enable impersonation and causes the source recording to be disclosed to an external service. While compliance.md mentions that voice-clone rights depend on the source audio, the actual cloning workflow does not enforce a consent check, ownership verification, public-figure restriction, or retention policy.

This is an insecure workflow design because a safety-critical authorization decision is omitted immediately before the sensitive upload and clone operation.

Attack Path

  1. A user obtains a clean recording of a third party from a video, podcast, call, or social-media post.
  2. The user treats that recording as a voice that “fits persona.” 3 ...[truncated 1038 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add a mandatory consent gate immediately before recording, uploading, or cloning source audio.
  2. Require documented proof that the speaker owns the voice or has granted explicit, informed, and revocable permission for cloning, commercial use, and third-party processing.
  3. Replace “any voice that fits persona” with “your own voice, a licensed synthetic voice, or a voice for which documented cloning consent exists.”
  4. Prohibit cloning public figures, employees, customers, minors, and unrelated third parties without independently verified authorization.
  5. Prefer provider-supplied or fully synthetic licensed voices when a unique human voice is unnecessary.
  6. Record the source, consent status, permitted uses, expiration date, and deletion requirements in the persona documentation.
  7. Define retention and deletion procedures for source recordings, generated samples, and provider-side clones.
  8. Require conspicuous disclosure that published audio is AI-generated or voice-cloned.
  9. Add an approval check before every production run to ensure the intended script and use remain within the speaker’s authorization.
  10. Store reusable voice identifiers with access controls rather than in broadly accessible documentation when the workspace may be shared.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly supports voice cloning, face consistency, face-swap/talking-head generation, and synthetic influencer creation, but it provides no up-front warning about impersonation, deception, consent, disclosure, or platform/legal risks. In this context, omission is dangerous because the core functionality can readily be used to create deceptive synthetic identities or clone a real person's likeness/voice without informed user friction.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · compliance.md (reported line 8)May include surrounding context.

md
### FTC Guidelines (USA)
AI-generated influencers MUST disclose:
- **#AIGenerated** or **#VirtualInfluencer** in visible location
- **Clear statement** that content is AI-generated
- **Sponsored content** disclosed same as human influencers

**Placement rules:**

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The section explicitly instructs users on how to reduce the detectability of AI-generated images, which facilitates deceptive impersonation and undisclosed synthetic-media use. In the context of a skill for creating and monetizing virtual influencers, this is especially dangerous because it operationalizes deception at scale rather than merely discussing image quality or disclosure best practices.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The workflow recommends generating audio with a cloned voice but provides no consent, authorization, or privacy safeguards. That omission makes it easy to use another person's voice for impersonation, fraud, or non-consensual synthetic media, especially in an influencer-building workflow designed for scalable content production.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The dedicated voice-cloning instructions operationalize recording, uploading, cloning, and storing a persistent voice identifier without any warning about consent, biometric privacy, retention, or misuse. Because voiceprints are sensitive and reusable across content, this creates a practical pathway for identity abuse and scalable impersonation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill includes broad, natural-language trigger phrases like 'Create new influencer' and 'Write captions for these' that are generic enough to match ordinary user requests outside a tightly scoped influencer workflow. This can cause unintended skill activation and route users into a capability set that includes synthetic identity creation and media generation, increasing the chance of misuse or inappropriate execution without explicit user intent.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · compliance.md (reported line 43)May include surrounding context.

md
### ❌ Prohibited
- Claiming AI influencer is a real person
- Using real person's likeness without consent
- Generating content that impersonates public figures
- Age-restricted content without verification
- Misleading claims about products (same as real influencers)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · compliance.md (reported line 56)May include surrounding context.

md
### ❌ Prohibited
- Claiming AI influencer is a real person
- Using real person's likeness without consent
- Generating content that impersonates public figures
- Age-restricted content without verification
- Misleading claims about products (same as real influencers)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · compliance.md (reported line 60)May include surrounding context.

md
### ❌ Prohibited
- Claiming AI influencer is a real person
- Using real person's likeness without consent
- Generating content that impersonates public figures
- Age-restricted content without verification
- Misleading claims about products (same as real influencers)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · compliance.md (reported line 45)May include surrounding context.

md
- Claiming AI influencer is a real person
- Using real person's likeness without consent
- Generating content that impersonates public figures
- Age-restricted content without verification
- Misleading claims about products (same as real influencers)

---

Ssd 4

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document first provides a workflow for generating consistent synthetic influencer imagery and then adds advice for making that content harder to detect, which normalizes deceptive deployment rather than creative assistance alone. Because the skill is specifically about managing and scaling AI influencers across platforms and monetization workflows, the deception guidance materially increases the risk of fraud, audience manipulation, and policy evasion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The Twitter/X guidance says AI content 'should' be disclosed only 'if asked,' which normalizes inconsistent disclosure for a synthetic persona. In a skill specifically about creating and scaling virtual influencers, this increases the risk of deceptive impersonation, misleading audiences and brands, and violating platform or advertising transparency expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The face-swap and generated 'candid' content guidance enables realistic synthetic identity manipulation without any caution about consent, likeness rights, or deception. In a virtual influencer context, these techniques can be used to falsely depict a person doing or saying things they never did, increasing reputational and fraud risks.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The 'Avoiding Detection' section explicitly gives tactics to make synthetic influencer content harder to recognize as AI-generated, including adding imperfections, mixing real footage, and creating generated 'candid' content. In the context of a virtual influencer skill, this goes beyond ordinary production advice and materially facilitates deceptive impersonation and platform-evasion behavior.

Content

No source excerpt is available for this finding.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

These steps are a concrete deception playbook for making AI-generated influencer videos seem authentically human and less detectable as synthetic. The surrounding skill context increases the danger because it is focused on scaling virtual personas across platforms, so the evasion guidance can directly support audience deception, policy circumvention, and fraudulent trust-building at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file gives operational instructions for cloning a person's voice but omits any consent, authorization, impersonation, or privacy safeguards. In the context of an AI influencer skill, this materially increases misuse risk because cloned voices can be used for deceptive endorsements, impersonation, fraud, or non-consensual synthetic identity creation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · voice.md (reported line 16)May include surrounding context.

bash
# Generate audio via API
curl -X POST "https://api.elevenlabs.io/v1/text-to-speech/VOICE_ID" \
  -H "xi-api-key: $ELEVENLABS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · voice.md (reported line 16)May include surrounding context.

bash
# Generate audio via API
curl -X POST "https://api.elevenlabs.io/v1/text-to-speech/VOICE_ID" \
  -H "xi-api-key: $ELEVENLABS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.