ClawHub
Back to skill

Security audit

ai-note-of-video

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrow video-notes helper that sends user-provided public video URLs to a disclosed external API, with privacy and script-verification caveats.

Install only if you are comfortable sending the selected public video URL to SkillBoss/HeyBossAI for processing. Use a dedicated API key if possible, avoid sensitive or private media links, and verify the referenced Python scripts before running them because they were not included in the reviewed artifact.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill documentation explicitly instructs users to send video URLs to a third-party API but does not warn that submitted URLs, and potentially the referenced media and related metadata, will be disclosed to an external service. This is a real privacy and data-handling issue because users may provide sensitive or internal links under the assumption the skill operates locally or without third-party sharing.

Static analysis

No suspicious patterns detected.