ClawHub
Back to skill

Security audit

Tri Platform Video Analysis

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed local video download, transcription, and HTML-report workflow with expected network and file access for that purpose.

Install only if you are comfortable with it downloading videos and a Whisper model, using optional platform cookies you explicitly provide, and writing transcript/report files locally. Prefer public or non-sensitive videos, keep cookies scoped to the target platform, and review generated HTML before opening reports from untrusted analysis content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill directs the agent to use network access, shell execution, and local file read/write operations, but it declares no permissions or equivalent trust boundaries. That mismatch is dangerous because users and orchestration layers may not realize the skill can download arbitrary remote content, consume local cookies files, write HTML to disk, and invoke Python scripts, increasing the chance of over-privileged execution or unsafe approval flows.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.