ClawHub

Tiktok Video Editor For Pc

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed cloud video-editing skill that sends chosen media and editing prompts to Nemovideo for processing.

Install only if you are comfortable sending selected videos, images, audio, and editing prompts to Nemovideo's cloud service. Keep NEMO_TOKEN private, monitor credit/export behavior, and avoid sensitive personal or confidential media unless you trust the provider's data handling.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The startup phrasing and example prompts are broad enough that ordinary conversation like 'export 1080p MP4' or 'edit my raw video clips' could trigger the skill without clear user intent to invoke this specific remote service. Because the skill uploads media and sends prompts to a cloud backend, accidental invocation can cause unintended data transfer and session creation.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The catch-all rule routes 'Everything else' to the SSE editing action, which is overly permissive and can treat unrelated user text as instructions for a remote backend. This increases the chance of unauthorized or accidental transmission of prompts and workflow actions, especially in mixed conversations.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
Although the file later mentions remote GPU processing, the user-facing description and onboarding do not prominently warn that uploaded media, prompts, and editing instructions are transmitted to a third-party cloud service. This is a meaningful privacy and consent issue because users may share personal or sensitive video content without realizing it leaves the local environment.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal