ClawHub
Back to skill

Security audit

infinitetalk

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed RunAPI video-generation recipe whose file upload and authentication behavior matches its stated purpose.

Before using the skill, confirm which local media files will be included in the request and remember they will be sent to RunAPI for processing. Use an API key or CLI login you intend to use for this service, and review any paid generation request before submission.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly directs the agent to place local file paths into request.json and states that the CLI will upload those local paths, but it does not require an explicit user confirmation or warning that local content will be transmitted to a third-party service. This creates a real risk of unintended exfiltration of sensitive local media or metadata, especially when an agent autonomously selects files or operates in a workspace containing private assets.

Static analysis

No suspicious patterns detected.