ClawHub
Back to skill

Security audit

Video Stream Upload Free

Security checks across malware telemetry and agentic risk

Overview

The skill is a real video uploader, but it needs Review because it can publicly upload local videos and send API secrets to a third-party service under broad trigger wording.

Install only if you intend to upload selected videos to this specific streaming service. Confirm the exact file path, title, destination account, and public visibility before use, and treat the stream secret key as sensitive; do not paste it where terminal history or logs may expose it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

High
Confidence
84% confidence
Finding
The trigger condition is overly broad and does not match the skill's real scope, which can cause the agent to invoke this skill for unrelated media tasks. In context, that is dangerous because the skill is capable of transmitting local files and API credentials to an external service, so misrouting could result in unintended data disclosure or accidental uploads.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs sending video content and authentication keys to a third-party endpoint without prominent consent, privacy, retention, or public-visibility warnings. This is especially risky here because the document also states uploads are public by default, so users may unknowingly expose sensitive media and secrets to an external service.

External Transmission

Medium
Category
Data Exfiltration
Content
END_POS=$((FILE_SIZE - 1))
HASH=$(md5sum /videos/python-tutorial.mp4 | awk '{print $1}')

curl -s -X POST "https://api-w3stream.attoaioz.cyou/api/videos/VIDEO_ID/part" \
  -H 'stream-public-key: PUBLIC_KEY' \
  -H 'stream-secret-key: SECRET_KEY' \
  -H "Content-Range: bytes 0-$END_POS/$FILE_SIZE" \
Confidence
96% confidence
Finding
curl -s -X POST "https://api-w3stream.attoaioz.cyou/api/videos/VIDEO_ID/part" \ -H 'stream-public-key: PUBLIC_KEY' \ -H 'stream-secret-key: SECRET_KEY' \ -H "Content-Range: bytes 0-$END_POS/$FIL

External Transmission

Medium
Category
Data Exfiltration
Content
export STREAM_SECRET_KEY="your_secret_key"

# 验证配置
curl -s 'https://api-w3stream.attoaioz.cyou/api/videos' \
  -X POST \
  -H "stream-public-key: $STREAM_PUBLIC_KEY" \
  -H "stream-secret-key: $STREAM_SECRET_KEY" \
Confidence
94% confidence
Finding
curl -s 'https://api-w3stream.attoaioz.cyou/api/videos' \ -X POST \ -H "stream-public-key: $STREAM_PUBLIC_KEY" \ -H "stream-secret-key: $STREAM_SECRET_KEY" \ -H "Content-Type: application/json

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.