ClawHub
Back to skill

Security audit

magic-hour

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent Magic Hour integration that uses an API key to generate media and optionally save outputs locally, with the main privacy consideration being that prompts and images go to Magic Hour's hosted service.

Install this only if you are comfortable sending generation prompts, selected input images, and job parameters to Magic Hour's hosted service. Keep `MAGIC_HOUR_API_KEY` private, use `--download-dir` only for directories where you want generated media saved, and check estimated credits before using paid or long-duration models.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill requires an API key from the environment and instructs users to save generated media locally via `--download-dir`, but it does not declare corresponding permissions. This creates a mismatch between what the skill can do and what users or a platform policy engine may expect, weakening transparency and consent around access to secrets and file writes.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The README describes prompt-based image/video generation via Magic Hour's API but does not clearly warn that user prompts, images, and related generation inputs are transmitted to a third-party hosted service. This can mislead users into submitting sensitive or proprietary content under the assumption the skill operates locally, creating privacy and data-handling risk rather than direct code-execution risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.