ClawHub
Back to skill

Security audit

Video Edit — Pro Pack on RunComfy

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent RunComfy video-editing skill that clearly discloses its external API use, token requirement, and output behavior.

Install this if you are comfortable sending source video URLs, optional reference images, and edit prompts to RunComfy for processing. When a request is ambiguous, confirm that the user intends cloud video editing and has provided an existing video before invoking the CLI.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger condition includes broad phrases and an 'any explicit ask to edit a video' clause, which can cause the skill to activate on loosely related requests without strong guardrails. Over-broad activation increases the chance of misrouting user intent, accidental third-party API calls, and unintended transmission of user-provided video URLs or prompts to RunComfy.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The routing guidance relies on broad natural-language examples ('swap the background', 'change the outfit', etc.) without clear exclusions or validation logic. In practice this can cause the agent to select and invoke an editing endpoint on ambiguous requests, leading to unintended data handling or external service usage.

Static analysis

No suspicious patterns detected.