ClawHub
Back to skill

Security audit

Video Content Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it can upload full video transcripts and reports to third-party services without enough privacy, permission, or retention controls.

Review before installing. Use this only with videos and transcripts you are comfortable sending to OpenAI and, if enabled, storing in Supabase or publishing to Feishu. Prefer a controlled working directory, avoid system-wide package changes where possible, use least-privilege API keys, confirm Feishu page visibility and Supabase RLS policies, and know how to delete stored records and reports.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill clearly describes sending user-provided video/audio/transcript content to external services such as OpenAI Whisper, Google Search, Supabase, and Feishu, but it does not present a prominent privacy/data-handling warning at the point of use. This can cause users to unknowingly transmit potentially sensitive media and derived transcripts to third parties, creating privacy and compliance risk.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 使用 Supabase REST API 写入元数据
curl -s -X POST "${SUPABASE_URL}/rest/v1/video_analyses" \
  -H "apikey: ${SUPABASE_ANON_KEY}" \
  -H "Authorization: Bearer ${SUPABASE_ANON_KEY}" \
  -H "Content-Type: application/json" \
Confidence
93% confidence
Finding
The Supabase write example transmits video URL, transcript text, engagement metrics, and analysis output to an external storage service. In the context of this skill, that may include sensitive media-derived content and creates data exposure risk if users are not clearly informed, if retention is uncontrolled, or if Supabase policies are misconfigured.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 正确：写入带链接的引用来源
curl -s -X POST \
  "https://open.feishu.cn/open-apis/docx/v1/documents/${OBJ_TOKEN}/blocks/${OBJ_TOKEN}/children" \
  -H "Authorization: Bearer ${TOKEN}" \
  -H "Content-Type: application/json" \
Confidence
91% confidence
Finding
The Feishu Wiki API example sends generated report content and external reference links to a third-party collaboration platform. Because the report can include transcripts, background research, and possibly sensitive source material, this represents external disclosure and persistence risk, especially if page permissions or workspace sharing are too broad.

Static analysis

No suspicious patterns detected.