ClawHub
Back to skill

Security audit

bili-tech-video-automation

Security checks across malware telemetry and agentic risk

Overview

This is a non-executable product-management template for designing video automation workflows, with disclosed compliance cautions around third-party content and publishing.

Before using this template for a real product, confirm that any content acquisition, downloading, translation, reposting, or automatic publishing is authorized by the source rights holder and supported by the target platform's official APIs or terms. Treat the compliance gates in the template as mandatory blockers, especially before any publishing workflow is built.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The skill states it is only a non-executable product-management template, but it also lays out a concrete end-to-end automation pipeline for content acquisition, processing, and publishing. This mismatch can mislead reviewers or downstream agents into underestimating that the document operationalizes potentially risky automation involving third-party platforms, copyright, and publishing actions.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The warning claims the skill does not include auto-publishing behavior, yet later sections define automatic publishing as a P0/core capability and part of the automated chain. This internal contradiction weakens safety assurances and may cause users or agents to treat a risky automation design as compliance-reviewed when it is not.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.