ClawHub
Back to skill

Security audit

Ai Video Studio Pro

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed AI video workflow, but it asks for command/file authority and includes optional public publishing without enough scoping or confirmation guidance.

Install only if you are comfortable with a video-generation skill that may write media files, run tools such as ffmpeg, call external AI/TTS/video APIs, and potentially publish outputs. Keep API keys in environment variables, review generated videos before any posting step, and require explicit confirmation before enabling publication or running non-ffmpeg commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill declares write, exec, and optional publishing behaviors without a prominent up-front warning or explicit user confirmation model. In an agent environment, that can lead to unintended file modification, shell command execution, or outbound publication if users invoke the skill without understanding its side effects.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.