ClawHub
Back to skill

Security audit

Sora Video Generation

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Sora video-generation helper that uses an OpenAI API key and sends user-provided prompts or images to OpenAI as expected.

Install only if you are comfortable sending video prompts, optional reference images, and request metadata to OpenAI and potentially incurring API costs. Prefer using OPENAI_API_KEY rather than passing the key on the command line, and avoid submitting sensitive, regulated, or unauthorized images.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill documents use of environment variables and outbound network access to call an external API, but the skill metadata does not declare corresponding permissions. This creates a transparency and governance gap: users or orchestration systems may invoke a capability that can access secrets and transmit data externally without an explicit permission signal.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The description uses broad activation language such as 'generate, create, or make videos,' which can cause the skill to trigger for a wide range of user requests. Over-broad routing increases the chance that user prompts, files, or API-backed actions are sent through this skill when a more specific confirmation or narrower tool selection would be safer.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation explains how to use the external video API but does not clearly warn that prompts, reference images, and authenticated requests are transmitted to a third-party service. This omission can lead users to unknowingly send sensitive text or images off-platform, especially because the skill supports file upload and uses an API key.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.