ClawHub
Back to skill

Security audit

Video to Notes

Security checks across malware telemetry and agentic risk

Overview

This appears to be a video-to-notes helper whose media processing and file output are expected for its purpose, with no evidence of theft, deception, or destructive behavior.

Install only if you are comfortable with a skill that may download a video or read a provided local media file, run media/transcription tools, and create transcript or note files. Use it with explicit sources and output locations, and review any dependency installation prompt before approving it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs the agent to execute shell commands and write output files, but it declares no corresponding permissions. That creates a hidden capability gap where users or the platform may not realize the skill can install packages, download content, and create artifacts on disk. In this context, the risk is increased because the workflow includes dependency checks, optional installation commands, downloads, and file generation, all of which should be explicitly permission-gated.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The documented behavior does not cleanly match the operational behavior: the skill can download remote videos, invoke ffmpeg-based transformations, and appears to rely on scripts that may only produce transcripts while the markdown claims full note generation. Behavior mismatches are dangerous because they undermine informed user consent and security review, especially when remote content retrieval and local file creation are involved. In this skill’s context, downloading and preprocessing external media expands the attack surface beyond simple note generation.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger conditions are broad enough to match common phrases like '帮我记笔记' or '转成学习笔记,' which could cause the skill to activate unexpectedly. Unintended activation is risky because this skill can lead to shell usage, local file access, and potentially remote downloads, so accidental invocation may expose user files or start actions the user did not intend. The surrounding context makes this more concerning than a purely conversational skill because the downstream actions are operational, not just textual.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The user-facing invocation text says the user can simply ask for notes and 'the AI handles the rest,' which encourages broad, low-friction activation without making the operational steps prominent. That is dangerous in a skill that may inspect environment dependencies, access local files, download network content, and create output files, because users may not appreciate that their request triggers system-level actions. The risk is contextual and stems from under-signaled operational side effects rather than overtly malicious logic.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.