ClawHub
Back to skill

Security audit

📐 Video Outpainting — Pro Pack on RunComfy

Security checks across malware telemetry and agentic risk

Overview

This appears to be a purpose-aligned video outpainting skill, with only a minor trigger-scoping concern and no artifact-backed evidence of hidden or unsafe behavior.

Install only if you are comfortable using it for video outpainting workflows. Avoid sending private or sensitive videos unless you understand which external service processes them and what account or API token the skill uses.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger text ends with "or any explicit ask to extend a video spatially beyond its original frame," which is a catch-all activation condition rather than a tightly scoped set of intents. Overly broad triggers can cause the skill to activate unexpectedly on loosely related user requests, increasing the chance that the agent invokes external tooling or routes work to this skill when another, safer or more appropriate skill should handle it.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.