ClawHub
Back to skill

Security audit

Video Translator Tool Free

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says by sending user-provided videos to an external translation service, so users should avoid confidential videos and review optional setup commands.

Install only if you are comfortable sending the selected video or video URL to the listed translation service using your API key. Do not use it for confidential, regulated, or private videos unless you accept the provider-side handling risk, and avoid running the optional sudo/package-install commands unless you intentionally want to modify the host environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
82% confidence
Finding
The skill includes package installation commands, including privileged installation guidance, even though package management is not part of the core translation task. In agent contexts with exec access, this can expand the execution surface, trigger unnecessary system modification, and normalize running setup commands with elevated privileges.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger condition is overly broad and overlaps with generic translation and localization requests, which can cause the skill to activate in contexts beyond its intended scope. Over-triggering is dangerous because it may cause unintended uploads of user-provided video content or prompt the agent to use this skill when a safer or more appropriate local workflow exists.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill clearly sends video files or remote video URLs to a third-party service but does not require a prominent user warning or explicit consent before transmission. This is risky because videos may contain sensitive personal, proprietary, or regulated content, and silent upload to an external provider can create privacy, compliance, and confidentiality exposure.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
brew install jq

# Ubuntu / Debian 安装 jq
sudo apt install jq

# 验证安装
curl --version
Confidence
91% confidence
Finding
sudo

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.