ClawHub
Back to skill

Security audit

Aoment Image Video

Security checks across malware telemetry and agentic risk

Overview

This is mostly a disclosed Aoment AI media tool, but its HD repair script can fetch any supplied web URL from the user's machine and upload the result to Aoment, which needs review before use.

Install only if you are comfortable sending prompts, images, videos, and audio to Aoment. Avoid using sensitive files or internal/private URLs, and prefer local media you intentionally selected until the publisher adds clearer privacy warnings and URL safety checks.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill supports local path inputs for images, videos, and audio and sends them to a remote AI service, but the description does not clearly warn users that their prompts and media may leave the local environment. This omission can lead to unintentional disclosure of sensitive personal, proprietary, or regulated data to a third party.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script accepts arbitrary image URLs, fetches them server-side, and then uploads the resulting content to the remote Aoment service without an explicit consent boundary at the operation site. This creates SSRF-style network access from the host running the tool and can also exfiltrate sensitive internal resources or locally intended-only data if a user or upstream agent supplies an internal URL.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.