ClawHub

Editorial Highlights

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent cloud video-highlighting tool, but users should know their media and prompts may be sent to NemoVideo for processing.

Install only if you are comfortable sending videos, editing prompts, and related session metadata to NemoVideo’s cloud service. Avoid confidential footage unless you have reviewed the provider’s privacy, retention, and account terms.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
87% confidence
Finding
The catch-all rule routes essentially any unrecognized request into the main SSE editing action, which can cause the skill to send unintended prompts or media-editing instructions to the backend. In a cloud-connected skill that may upload/process user media and mutate session state, overbroad intent matching increases the chance of accidental actions, privacy-impacting requests, and user-confusing behavior.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to connect to a remote backend, obtain tokens, create sessions, and process uploaded video in the cloud, but the user-facing description does not clearly warn that media and prompts will be transmitted off-device. For journalists, editors, and videographers, footage may be sensitive or confidential, so lack of clear disclosure undermines informed consent and can create privacy and data-handling risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal