ClawHub

Kre Video Translator

Security checks across malware telemetry and agentic risk

Overview

This skill transparently translates user-chosen media by sending extracted audio to KreTrans and writing a subtitle file locally.

Install only if you are comfortable sending selected media audio, filenames, and language settings to KreTrans. Use a revocable KreTrans API key, avoid highly sensitive recordings unless you trust the service, and be careful with URL or magnet inputs because those require external download tools before translation.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill performs sensitive operations including shell execution, network access, environment-variable use, and file writes, but does not declare corresponding permissions. This creates a governance and transparency gap: callers may invoke a skill with broader capabilities than expected, increasing the risk of unintended data access, outbound transmission, or command execution without explicit review.

External Transmission

Medium
Category
Data Exfiltration
Content
- `aria2c`

`translate.py` only accepts local file input.
The script sends requests to `https://api.kretrans.com/v1/api`.
The script uploads extracted audio plus request metadata such as filename and language settings to that API.

## Python Launcher
Confidence
89% confidence
Finding
https://api.kretrans.com/

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal