ClawHub
Back to skill

Security audit

小红书爆款种草视频生成与编辑

Security checks across malware telemetry and agentic risk

Overview

This skill is a purpose-aligned video-generation wrapper that uses an AI Hive API key and user-selected media, with no hidden automatic execution found.

Before installing, be comfortable with AI Hive receiving your prompts and any media files you explicitly pass to the tool. The init command stores an API key locally, so treat that file as a credential and avoid uploading private or third-party media unless you intend to send it to the provider.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill exposes or implies shell, file, environment, and network-capable operations without declaring permissions, which weakens reviewability and informed consent for users. In this context, the commands install packages, initialize tooling, query tasks, and process local media, so undeclared capabilities could enable broader filesystem or network access than the user expects.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose is narrowly framed as Xiaohongshu video generation/editing, but the underlying behavior reportedly includes generic chat, image generation, account and wallet retrieval, model enumeration, media upload, and local credential setup. That mismatch is dangerous because users may authorize the skill for a limited creative task while it can access credentials, account metadata, or unrelated services beyond the stated use case.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.