ClawHub
Back to skill

Security audit

Morfeo Remotion Style

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a Remotion video style guide with normal example assets and no evidence of hidden or harmful behavior.

Install this if you want Morfeo-specific Remotion styling defaults. Be aware it may apply its guidance broadly to Paul’s Remotion video requests, and the sample copy appears Spanish-focused, so users wanting neutral or multilingual examples may need to override the wording.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The manifest description lists several specific trigger phrases, but then expands scope to "any Remotion video request from Paul," which is ambiguous and potentially broad. It does not define boundaries or exclusion conditions for what counts as a Remotion request, increasing the chance of unintended invocation.

Natural-Language Policy Violations

Low
Confidence
91% confidence
Finding
This TSX file contains multiple hard-coded Spanish UI strings such as "ESTO ES BLACK MIRROR", "Todo el mundo habla de", and "Le mandás un audio y te responde". For all file types, policy findings should be raised when a skill forces a specific language without offering user choice or documenting a justified locale constraint.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.