ClawHub
Back to skill

Security audit

ReelOnce-skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed text-to-video workflow, but users should understand that it uses external generation services and installs/render dependencies during normal use.

Install only in a ReelOnce repository you trust, inspect the generated Remotion project before full rendering if dependency execution matters to you, keep env.local and API keys private, and avoid using sensitive local images or story material unless you trust the configured video provider.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill states that commercial video service requests may send local images as URLs or base64, but it does not present this as an explicit user-facing warning before execution or obtain clear consent. This can lead to unintentional transmission of sensitive local media or derived assets to third-party services during processing, especially in an end-to-end automation flow.

Static analysis

No suspicious patterns detected.