ClawHub
Back to skill

Security audit

Video Content Analyzer

Security checks across malware telemetry and agentic risk

Overview

The skill does what it says, but it can upload full video transcripts and reports to third-party services without enough privacy, permission, or retention controls.

Review before installing. Use this only with videos and transcripts you are comfortable sending to OpenAI and, if enabled, storing in Supabase or publishing to Feishu. Prefer a controlled working directory, avoid system-wide package changes where possible, use least-privilege API keys, confirm Feishu page visibility and Supabase RLS policies, and know how to delete stored records and reports.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill clearly describes sending user-provided video/audio/transcript content to external services such as OpenAI Whisper, Google Search, Supabase, and Feishu, but it does not present a prominent privacy/data-handling warning at the point of use. This can cause users to unknowingly transmit potentially sensitive media and derived transcripts to third parties, creating privacy and compliance risk.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 使用 Supabase REST API 写入元数据
curl -s -X POST "${SUPABASE_URL}/rest/v1/video_analyses" \
  -H "apikey: ${SUPABASE_ANON_KEY}" \
  -H "Authorization: Bearer ${SUPABASE_ANON_KEY}" \
  -H "Content-Type: application/json" \
Confidence
93% confidence
Finding
curl -s -X POST "${SUPABASE_URL}/rest/v1/video_analyses" \ -H "apikey: ${SUPABASE_ANON_KEY}" \ -H "Authorization: Bearer ${SUPABASE_ANON_KEY}" \ -H "Content-Type: application/json" \ -H "Prefe

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 正确：写入带链接的引用来源
curl -s -X POST \
  "https://open.feishu.cn/open-apis/docx/v1/documents/${OBJ_TOKEN}/blocks/${OBJ_TOKEN}/children" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
Confidence
91% confidence
Finding
curl -s -X POST \ "https://open.feishu.cn/open-apis/docx/v1/documents/${OBJ_TOKEN}/blocks/${OBJ_TOKEN}/children" \ -H "Authorization: Bearer ${TOKEN}" \ -H "Content-Type: application/json" \ -

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.