ClawHub
Back to skill

Security audit

视频生成与编辑

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AI Hive video-generation helper that uploads user-selected media, uses an API key, polls jobs, and downloads results as expected for its purpose.

Install only if you are comfortable sending the prompts and any selected images, video, or audio to AI Hive for processing. Use the default AI Hive base URL unless you intentionally trust another endpoint, and protect the API key stored in `~/.ai-hive/config.json`.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documents capabilities that read environment variables, read/write local files, invoke shell commands, and make network requests, but it does not declare permissions. This weakens user and platform trust boundaries because a caller may invoke the skill without understanding it can access API keys, write config files, upload local media, or launch subprocesses.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose is narrowly scoped to video generation/editing, but the underlying behavior reportedly also supports unrelated text chat, image generation, account and wallet queries, broad model enumeration, and interactive API-key setup. This scope mismatch is dangerous because users may provide credentials or authorize the skill for a limited task while the implementation has broader data access and action surface than advertised.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill repeatedly states that it will automatically upload user-provided media, poll remote tasks, and download outputs, but it does not give a clear upfront privacy/data-handling warning. In this context, users may unknowingly send sensitive videos, images, or audio to a third-party service and store returned artifacts locally without understanding retention, visibility, or jurisdictional implications.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.