ClawHub
Back to skill

Security audit

Synthesia

Security checks across malware telemetry and agentic risk

Overview

This is a guidance-only Synthesia avatar-video skill that consistently requires consent, disclosure, and human approval before publishing.

Before installing, users should understand that the skill is meant for AI-avatar video planning and may interact with connected Synthesia or publishing workflows if those integrations exist. Use it only with consented likenesses, keep human review in place, and verify pricing, API access, disclosure rules, and regulated-content requirements before production use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Unbounded Output

Medium
Category
Output Handling
Content
capcut if needed → scheduling-and-queue → WoopSocial.

## The reality (verify-quarterly)
Synthesia 3.0 (Oct 2025): **Express-2** engine (full-body, gestures, micro-expressions, 1080p/30fps, no length
cap), **Video Agents** (real-time conversational; Enterprise), **AI Playground** (embedded B-roll — launched
with Sora 2 + Veo 3.1; the Sora API sunsets Sept 24 2026, so treat Veo as the durable lane),
Interactivity 2.0, AI Dubbing, Copilot, doc/PPT→video, SSML, ~real-time rendering, 39+ subtitle
Confidence
75% confidence
Finding
no length cap

Unbounded Output

Medium
Category
Output Handling
Content
medical/pharma topics, cinematic brand storytelling.

## Synthesia 3.0 (Oct 2025) + the 2026 stack (attribute)
**Express-2 engine** — full-body movement, hand gestures, micro-expressions, 1080p/30fps, no length cap ·
**Video Agents** — real-time conversational avatars (Enterprise) · **AI Playground** — embedded B-roll
inside the editor (launched with Sora 2 + Veo 3.1; OpenAI's Sora API sunsets Sept 24 2026 — treat the
Veo lane as the durable one) · Interactivity 2.0 (quizzes/polls/hotspots), Courses, **AI Dubbing**, Copilot
Confidence
22% confidence
Finding
no length cap

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.