ClawHub
Back to skill

Security audit

Google Gemini Media

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Gemini media workflow guide whose API calls, file uploads, API key use, and local output examples fit its stated purpose.

Before installing or using this skill, confirm you are allowed to send the selected media and prompts to Google services, especially for meeting recordings or regulated data. Keep GEMINI_API_KEY out of source control, monitor quota or billing impact, and change fixed example filenames like out.png or out.mp4 if overwriting local files would matter.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs users to upload media via the Gemini Files API and external REST endpoints but does not clearly warn that user-provided images, audio, and video are transmitted to Google-hosted services. In a multimodal workflow skill, this omission can cause operators to unknowingly send sensitive or regulated data off-device, creating privacy, confidentiality, and compliance risk.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The example workflow explicitly suggests uploading meeting audio for transcription and summarization, but it omits a direct warning that meetings often contain sensitive personal, business, or regulated information. That increases the likelihood of accidental disclosure of confidential conversations to a third-party cloud service and may violate consent, privacy, or data-governance requirements.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.