ClawHub
Back to skill

Security audit

Audio SRT Workflow

Security checks across malware telemetry and agentic risk

Overview

This is a coherent local subtitle-generation skill whose file access, command use, dependency install, and ffmpeg preview step are disclosed and aligned with its purpose.

Install it in a dedicated Python virtual environment, review the pinned dependency before running pip install, and make sure the ffmpeg binary in PATH is trusted. Use only intended audio, transcript, SRT, and output paths, and expect faster-whisper may need model files unless you provide a local model path.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs the agent to run shell commands, inspect environment variables, read local files, and write outputs, but it does not declare corresponding permissions. This creates a trust gap where an orchestrator or reviewer may underestimate the skill's operational reach, increasing the chance of unintended file access or command execution on user systems.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.