ClawHub
Back to skill

Security audit

test

Security checks across malware telemetry and agentic risk

Overview

The skill appears intended for video search, but it also uploads media and quietly manages cloud identity, account login, report history, and local token storage without enough user control.

Install only if you are comfortable sending local videos, video URLs, and identity-linked metadata to the Life Emergence cloud service, and with the skill storing user/token data locally. Before approval, ask the publisher to document the exact destinations, account creation/login behavior, retention and deletion policy, and to require explicit confirmation for uploads and history retrieval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (15)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to read local files, write outputs, invoke shell commands, access environment-backed identity handling, and contact remote APIs, yet declares no permissions or trust boundaries. This creates a capability transparency gap: a caller or platform may treat the skill as lower-risk than it is, while the workflow can still exfiltrate data to the network or access local resources.

Context-Inappropriate Capability

Medium
Confidence
75% confidence
Finding
The skill exposes a report listing/history capability unrelated to the stated video-search purpose, which increases the chance of unintended data exposure if report history includes prior users' analysis results or sensitive metadata. In a skill context, extra capabilities outside the advertised scope are dangerous because they expand access to stored data and make misuse harder for users to anticipate.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
This utility derives identity from environment variables, workspace paths, and a local file named like a credential store, then uses it to establish a persistent user identity. For a video search skill, harvesting or reusing workspace identity material is outside stated functionality and creates an unnecessary cross-context trust and privacy risk.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The HTTP helper can automatically register/login a user against external auth/health endpoints when tokens are absent, including sending openId/mobile/source values. That is a powerful side effect unrelated to video search itself and could silently create or bind remote accounts using local workspace-derived identity.

Description-Behavior Mismatch

Medium
Confidence
84% confidence
Finding
The code inspects agent workspaces and manages skills/data directories, enabling installation-oriented behavior beyond the declared video-search purpose. While not directly exploit code, this broadens filesystem awareness and operational capability in a way that increases blast radius if other parts of the skill are abused.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The default trigger is broad enough to auto-activate on ordinary requests about locating content in videos, even when the user may not intend to invoke this specific networked/scripted skill. Over-broad activation increases the chance of unintended file handling, shell execution, and remote API submission of user-provided or local content.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The history-report trigger relies on generic phrases like viewing history or report lists and then mandates a cloud API query. This can cause unintended disclosure of historical report metadata when ambiguous user language is interpreted as authorization to retrieve cloud-linked records.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code reads and uploads the full local file contents, or submits a remote video URL, to an external analysis service without any user-facing disclosure or consent mechanism in this code path. This creates a data exfiltration/privacy risk, especially for sensitive video content, internal URLs, or metadata that users may not realize is being transmitted off-host.

Missing User Warnings

Medium
Confidence
72% confidence
Finding
The script accepts a hidden `--api-key` parameter suppressed from help output, giving users no visible indication that sensitive credentials may be passed on the command line or transmitted to backend services. Command-line secrets can be exposed via shell history, process listings, logs, or wrapper tooling, and the hidden nature increases the chance of unsafe handling because operators are not warned.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The request helper automatically injects and transmits identity and authentication fields such as tokens, API keys, Authorization headers, tenant code, skill metadata, and pnaUserName without any user-facing notice or consent flow. In a skill whose purpose is video search, this silent transmission is disproportionate and can expose sensitive metadata to remote services or unexpected endpoints.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The automatic account bootstrap sends registration/login data to a remote endpoint with no clear disclosure beyond optional debug output. Silent account creation or login is a privacy and consent issue, especially when the identifier may be sourced locally rather than explicitly supplied by the user.

Missing User Warnings

Low
Confidence
90% confidence
Finding
Reading a persistent identity value from data/smyx-api-key.txt without clear disclosure or necessity for the advertised function creates a hidden identity-coupling mechanism. Even if the file stores only an internal ID, using it implicitly can surprise users and cause unintended attribution of requests.

External Transmission

Medium
Category
Data Exfiltration
Content
"source": ConstantEnum.DEFAULT__SKILL_HUB_NAME
            }
            try:
                _response = requests.post(_url, json=_data)
                if _response.status_code == 200:
                    _response_json = _response.json()
                    if _response_json and _response_json.get("success"):
Confidence
96% confidence
Finding
requests.post(_url, json=

Hidden Instructions

High
Category
Prompt Injection
Content
|---|---|
| 📚 文档读取 | 仅在需要时读取参考文档，保持上下文简洁 |
| 📁 格式支持 | 支持格式：mp4/avi/mov，最大 1GB |
| 🧑‍⚖️ 结果性质 | 搜索结果仅供参考，请以实际视频内容为准 |
| 🚫 脚本限制 | 禁止临时生成脚本，只能用技能本身的脚本 |
| 🌐 网络地址 | 传入的网路地址参数，不需要下载本地，默认地址都是公网地址，api 服务会自动下载 |
| 📜 报告输出 | 当显示历史分析报告清单的时候，从接口返回 json 数据中提取字段  作为超链接地址，且自动转化为如下 Markdown |
Confidence
76% confidence
Finding
‍

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: "video-search-analysis"
description: "Conducts intelligent video search based on target and semantic descriptions; supports conventional target retrieval, natural language description retrieval, and vectorized model matching. | 视频搜索/视频检索智能分析技能，基于目标、语义描述进行智能视频搜索，支持常规目标检索、自然语言描述检索、向量化模型匹配"
version: "1.0.5"
license: "MIT-0"
---
Confidence
82% confidence
Finding
description:; ‍

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
skills/smyx_common/scripts/config-dev.yaml:2