ClawHub
Back to skill

Security audit

Tomoviee Text to Sound Effects

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Tomoviee text-to-sound-effects API helper, with credential-handling risks users should manage carefully.

Install only if you intend to use the Tomoviee/Wondershare text-to-sound-effects API. Run the scripts in a private local environment, avoid passing real secrets on command lines when shell history or process listings may be visible, keep generated Basic tokens out of logs and CI output, and rotate credentials if they may have been exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script instructs users to pass the application secret on the command line, which can expose credentials through shell history, process listings, audit logs, or CI job metadata. Although the script is not overtly malicious, this handling pattern unnecessarily increases the chance of credential disclosure.

Credential Access

High
Category
Privilege Escalation
Content
app_secret = sys.argv[2]
    
    token = generate_access_token(app_key, app_secret)
    print(f"Access Token: {token}")
    print(f"\nUse in Authorization header as: Basic {token}")
Confidence
97% confidence
Finding
Access Token

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.