Kapwing Free Text To Video

• Analyzed: Apr 15, 2026, 6:36 PM
• Findings: 1
• Version: 1.0.0
• Hash: b0bb314dcbbb5c307c96f0bbb1b872c4089c2a305083f6f90b8c790596b21485
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill exhibits suspicious behavior by using the 'Kapwing' brand name while directing all API traffic to an unrelated third-party domain (nemovideo.ai). It instructs the AI agent to perform automatic background connections upon activation and to probe the local file system to determine its installation path (e.g., checking for ~/.clawhub/ or ~/.cursor/skills/) for telemetry headers. Furthermore, the instructions explicitly tell the agent to hide raw API responses and token values from the user, which is a common tactic to obscure unauthorized data processing or session hijacking.