ClawHub
Back to skill

Security audit

HeyGen 视频生成替代｜AI 视频生成与编辑

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent AI video-generation helper that uses a disclosed AI Hive API, user-selected media, and a user-provided API key.

Install only if you are comfortable sending the prompts and media files you choose to AI Hive for generation. Use authorized presenter/product assets, avoid private or regulated media unless your organization approves that service, and protect the AI Hive API key stored in ~/.ai-hive/config.json or provided through AI_HIVE_API_KEY.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script transmits local image/video content to an external service via `upload_visual`, and later submits prompt and media references to the remote generation API. While these network operations are central to the tool's function, this file provides no inline user-facing warning about remote transfer of user data beyond generic status prints, and there is no visible confirmation prompt or privacy disclosure in the code.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
Natural-language strings throughout the file, including the module docstring and CLI descriptions, are presented only in Chinese. This can violate a language/locale policy when the skill forces a specific language without giving the user a choice or documenting the locale restriction as intentional.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def secret_key(command_value=None):
    if command_value:
        return command_value
    environment = os.environ.get("AI_HIVE_API_KEY")
    if environment:
        return environment
    try:
Confidence
70% confidence
Finding
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.