ClawHub
Back to skill

Security audit

Vidu 视频生成替代｜AI 视频生成与编辑

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent AI video-generation helper that sends user-selected prompts and media to AI Hive, stores an API key locally when initialized, and downloads generated results.

Install only if you are comfortable using AI Hive for video generation. Do not pass private or regulated media files unless you intend to upload them to the service, and use a dedicated AI Hive API key because the skill can store it locally for reuse.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill invokes a Python script with shell commands, reads local files as inputs, may write task state/output, uses environment-based secrets, and performs network requests to an external API, yet no permissions are declared. This creates a trust and containment gap: users or the platform may not realize the skill can access files, environment variables, and the network, increasing the risk of unintended data exposure or overly broad execution.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The description contains broad search-driven trigger phrases such as alternative/comparison/API/multi-reference terms without clear activation boundaries. This can cause the skill to activate in loosely related contexts, leading users to run a capability-bearing skill unexpectedly, which is more concerning here because the skill can invoke code and network operations.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The generate/upload commands accept local image, video, and audio paths and then transmit those files to a remote AI Hive service, but the CLI help shown to users does not clearly warn that local media will leave the machine. This is risky because users may unknowingly upload sensitive personal, proprietary, or regulated content to a third-party service.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.