ClawHub
Back to skill

Security audit

Ai Video Generation

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward external AI video-generation helper, with cautions around the remote CLI installer and sending prompts or media URLs to inference.sh-backed services.

Install only if you trust inference.sh and its CLI installer. Prefer manual checksum verification where practical, use the intended inference.sh account, and avoid submitting confidential prompts, private media, internal URLs, or regulated content unless you are comfortable with external processing by inference.sh and its providers.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger list contains very broad phrases such as 'video generation', 'generate video', and 'ai animation', which can cause the skill to activate in contexts where the user did not specifically intend to invoke this particular external-service workflow. In an agent setting, unintended activation is risky because it may route user prompts or media to third-party video services and trigger costly or privacy-sensitive actions without clear user intent.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs users to provide prompts, image URLs, audio URLs, and video URLs to external apps but does not warn that this data will be sent to third-party services for processing. In this context, the omission is significant because the skill is explicitly designed for user media uploads and content generation, creating privacy, consent, and data-governance risks if users submit sensitive or proprietary material without adequate notice.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.