ClawHub
Back to skill

Security audit

image-to-video-gen

Security checks across malware telemetry and agentic risk

Overview

This skill clearly performs user-requested image-to-video generation using Google APIs, with local output files, and does not show hidden or unrelated behavior.

Install only if you are comfortable sending the selected image and generated prompt text to Google APIs and storing the original image, analysis, prompt, and video in the OpenClaw workspace. Avoid using sensitive, private, regulated, or proprietary imagery unless that use is permitted by your policies.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill sends user-supplied images and model-generated prompt content to external Google APIs, but the documentation does not clearly warn users that their content leaves the local environment. This creates a real privacy and compliance risk, especially if users process sensitive, proprietary, or personal imagery without informed consent.

External Transmission

Medium
Category
Data Exfiltration
Content
}

print("\n🎬 Calling Veo API...")
response = requests.post(VEO_URL, json=payload, timeout=60)

if response.status_code not in [200, 202]:
    print(f"✗ API error: {response.json()}")
Confidence
88% confidence
Finding
requests.post(VEO_URL, json=

External Transmission

Medium
Category
Data Exfiltration
Content
VEO_URL = f"https://generativelanguage.googleapis.com/v1beta/models/veo-3.0-generate-001:predictLongRunning?key={GOOGLE_API_KEY}"

response = requests.post(VEO_URL, json=payload, timeout=60)
result = response.json()

if response.status_code in [200, 202]:
Confidence
88% confidence
Finding
requests.post(VEO_URL, json=

Session Persistence

Medium
Category
Rogue Agent
Content
f.write(analysis)
print(f"✓ Analysis: {prompt_path.name}")

# Step 3: Create enhanced prompt
enhanced = f"""VIDEO GENERATION PROMPT
Duration: 5 seconds
Quality: High Definition
Confidence
83% confidence
Finding
Create enhanced prompt enhanced = f"""VIDEO GENERATION PROMPT Duration: 5 seconds Quality: High Definition SCENE ANALYSIS: {analysis} MOTION GUIDELINES: - Smooth, deliberate camera movement - Enhanc

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.