ClawHub
Back to skill

Security audit

Kling 3.0 — AI Video Generation by Kuaishou

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Atlas Cloud video-generation helper; it sends prompts and media references to a paid external API, but I did not find hidden persistence, destructive behavior, or covert data collection.

Install only if you are comfortable sending prompts, media URLs, and any uploaded media to Atlas Cloud under your API key and paying for generation. Review the exact model ID before running because the helper can call any Atlas Cloud video model, not only the Kling models described in the skill text.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The description overstates and narrows the skill in ways the code does not support. The script does perform video-generation-related actions through Atlas Cloud, so it is in the same broad domain, but its real behavior is a generic wrapper for Atlas Cloud's video generation endpoint. It accepts any model ID, validates against Atlas Cloud's model list, and can upload media and download outputs. There is no Kling-specific logic, no confirmation that Kling models are used, no dedicated video editing operations such as object removal/background replacement, and no implementation of the many detailed product claims in the description. Therefore the declared description does not accurately represent the actual code behavior.

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
The implemented behavior is not a Kling-specific skill but a generic Atlas Cloud video client, despite the manifest advertising Kling/Kuaishou capabilities and pricing. In a skill ecosystem, this is dangerous because users may authorize uploads of local media and submit sensitive prompts under false assumptions about the backend, creating a material integrity and data-governance risk.

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill requires environment access for an API key and performs network operations, but it does not declare any explicit tool scope or allowed-tools boundary. That omission weakens least-privilege controls and can allow broader-than-expected execution in hosts that rely on manifest permissions for sandboxing and user awareness.

Vague Triggers

Medium
Confidence
97% confidence
Finding
The trigger language is extremely broad and can cause the skill to activate for many generic video-related requests. In an agent environment, over-triggering can route user content and media to an external paid API unexpectedly, increasing privacy, consent, and cost risks.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Submit
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
84% confidence
Finding
The skill explicitly transmits user prompts and potentially media references to a third-party service using a bearer token. This is expected for a cloud video generation skill, but it is still a real data egress risk because sensitive prompts, image URLs, video URLs, and billing-backed credentials leave the local environment.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Submit
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
84% confidence
Finding
The skill explicitly transmits user prompts and potentially media references to a third-party service using a bearer token. This is expected for a cloud video generation skill, but it is still a real data egress risk because sensitive prompts, image URLs, video URLs, and billing-backed credentials leave the local environment.

External Transmission

Medium
Category
Data Exfiltration
Content
### Video Editing Example (O3 Pro)

```bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
81% confidence
Finding
The video-edit example sends a source video URL and editing instructions to an external service, which can involve especially sensitive user media. In context, this increases the privacy impact relative to text-only prompts because full audiovisual content may be processed by a third party.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The file header and usage examples describe Kling/Kuaishou video functionality, but the implementation actually sends requests to Atlas Cloud using unrelated model identifiers. This is a deceptive capability mismatch that can cause users to transmit prompts, media, and API credentials to an unexpected third-party service, undermining informed consent and supply-chain trust.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
import urllib.error
import urllib.parse

API_BASE = "https://api.atlascloud.ai/api/v1"


def get_api_key():
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.