ClawHub

Vidu — AI Video Generation - Vidu Q3 & Vidu 2.0

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Atlas Cloud video-generation skill with normal privacy and billing cautions, not evidence of hidden or destructive behavior.

Install only if you intend to use Atlas Cloud for paid video generation. Protect the ATLASCLOUD_API_KEY, monitor spending, confirm before sending prompts or media, and avoid uploading confidential, private, or rights-sensitive images, videos, audio, or likenesses unless you are comfortable processing them through Atlas Cloud.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill clearly requires an environment variable and performs outbound network operations, but it does not declare explicit permissions for those capabilities. That weakens platform-level review and user awareness, making secret use and data egress easier to hide or misunderstand. In this context, the skill is expected to call a remote API, so the behavior is somewhat context-aligned, but the missing declaration still reduces transparency and increases operational risk.

Tp4

High
Category
MCP Tool Poisoning
Confidence
86% confidence
Finding
The documented purpose is narrowly framed around Vidu video generation, but the skill behavior appears broader: model listing, local file upload, generic video-to-video handling, and arbitrary passthrough parameters. This mismatch matters because users and reviewers may consent to a limited-purpose media generator while the implementation can transfer additional local content or invoke broader remote functionality than advertised. The video-generation context makes some remote processing expected, but undocumented upload and generic parameter passthrough materially increase risk.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger description is overly broad and could activate on many generic creative or marketing requests, causing the skill to run in situations where users did not specifically intend to use this third-party service. That can lead to unnecessary data transmission, billing, or file handling through Atlas Cloud. The skill’s domain is legitimate, but broad auto-triggering makes inadvertent use more likely and therefore raises the practical risk.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Submit
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
94% confidence
Finding
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \ -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "model": "vidu/q3-pro/te

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Step 1: Submit
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
94% confidence
Finding
https://api.atlascloud.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
# Returns: { "code": 200, "data": { "id": "prediction-id" } }

# Step 2: Poll (every 5 seconds until completed)
curl -s "https://api.atlascloud.ai/api/v1/model/prediction/{prediction-id}" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY"
# Returns: { "code": 200, "data": { "status": "completed", "outputs": ["https://...video-url..."] } }
Confidence
88% confidence
Finding
https://api.atlascloud.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
### Image-to-Video Example (Q3-Pro)

```bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
93% confidence
Finding
https://api.atlascloud.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
### Anime Style Example (Q3-Pro)

```bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
90% confidence
Finding
https://api.atlascloud.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
### Start-End Interpolation Example (2.0)

```bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
92% confidence
Finding
https://api.atlascloud.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
### Reference-to-Video Example (2.0)

```bash
curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateVideo" \
  -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
92% confidence
Finding
https://api.atlascloud.ai/

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal