ClawHub

SaaS Video

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed wrapper for Pexo’s hosted video service, with normal credential and data-sharing risks for that workflow.

Install only if you are comfortable sending the described product details, URLs, screenshots, and media to Pexo and potentially spending Pexo credits. Store ~/.pexo/config as a secret, keep it writable only by you, do not point PEXO_CONFIG at untrusted files, and avoid submitting confidential internal URLs, secrets, customer data, or proprietary material without approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The script sources the user-controlled config file with `source "$config_path"`, which executes arbitrary shell code rather than parsing only expected key/value settings. If the config file is modified by another local process, copied from an untrusted source, or pointed elsewhere via `PEXO_CONFIG`, running this diagnostic script will execute attacker-supplied commands with the user's privileges.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README explicitly instructs users to provide product descriptions or app URLs to a hosted Pexo backend, but it does not clearly warn that this information will leave the local environment and be transmitted to a third-party service. In a security-sensitive agent ecosystem, users may paste internal app URLs or proprietary product details, so the lack of an explicit disclosure increases the risk of unintended data exposure.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The setup guide instructs users to place a live API key in a plaintext config file but does not warn them to protect that file with restrictive permissions or keep the key secret. This increases the chance of accidental credential exposure through backups, shared home directories, screenshots, dotfile syncing, or permissive filesystem defaults.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal