ClawHub
Back to skill

Security audit

Shell Image Video

Security checks across malware telemetry and agentic risk

Overview

This AI media skill matches its stated purpose, but it needs Review because it exposes a RunningHub API key and asks agents to run missing local scripts on sensitive face, voice, image, and video media.

Review before installing. The publisher should remove and rotate the exposed API key, provide the referenced scripts for review, and add clear consent/privacy guidance for face, voice, image, and video uploads. Users should supply their own provider credential only through a safe environment variable or secret store and use only media they have rights and consent to process.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

High
Confidence
99% confidence
Finding
The file explicitly discloses a hardcoded API key, which is a real secret exposure vulnerability. Anyone with access to the skill can reuse the credential to consume paid API resources, impersonate the account, access associated workflow operations, or trigger quota exhaustion and billing abuse; in a media-generation skill that calls third-party services, this context makes credential leakage especially dangerous because the key likely grants direct external API access.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.