ClawHub
Back to skill

Security audit

Runway 视频生成替代｜AI 视频生成与编辑

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a disclosed AI video generation helper that uploads user-selected media to AI Hive and saves generated results locally.

Before installing, confirm you are comfortable sending any media files you pass on the command line to AI Hive or provider-issued upload URLs, and storing an AI Hive API key locally or in an environment variable. Use only authorized source footage and review output paths if you do not want generated files saved under the default Downloads location.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill invokes a Python script with network, file, environment, and shell capabilities, but does not declare permissions or constrain their use in the manifest. That mismatch reduces transparency and can let a broadly activated skill perform higher-risk actions than users or reviewers expect, especially when processing local media files and making outbound API calls.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The description contains broad trigger phrases such as generic Runway alternatives, API, AI film shots, ads, editing, and extension terms, which can cause the skill to activate for common search intent outside a clearly bounded use case. Over-broad activation increases the chance that code-capable behavior is invoked unexpectedly, creating opportunities for unintended file or network operations in irrelevant contexts.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.