ClawHub
Back to skill

Security audit

Video Frame Analyzer

Security checks across malware telemetry and agentic risk

Overview

The skill coherently extracts frames from user-provided videos and creates analysis reports, with no evidence of hidden network access, credential use, destructive behavior, or deception.

Install only if you are comfortable running local Python video-processing scripts and creating frame/report files in your workspace. Use it on videos you are allowed to analyze, confirm the output directory first, and avoid sending sensitive frames to a multimodal model provider you do not trust.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
85% confidence
Finding
The trigger phrases are very broad and map to ordinary user requests such as '分析这个视频' or '帮我分析竞品视频', which can cause unintended activation of the skill in contexts where the user did not explicitly consent to its workflow. That matters because the workflow includes shell execution, dependency installation suggestions, frame extraction, and file creation, so accidental invocation can lead to unanticipated local actions and processing of user files.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs the agent to write analysis outputs into local markdown files without clearly warning the user beforehand that files will be created or appended in the working directory. This can surprise users, overwrite expected artifacts, expose sensitive derived content on disk, or create persistence they did not intend, especially when analyzing private videos.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.