ClawAudit verdict

tiktok-video-maker

🟠 Risky

Significant concerns — only install if you understand the risks

Accesses credentials AND makes external network calls

skill accesses LovelyBots API key, potential credential exposure

Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.

security

transparency

maintenance

What it does

These are capability combinations: each listed behavior occurs in the skill, but ClawAudit detects co-occurrence — it does not verify that one flows into another. Read the code to confirm a live chain.

Capability combination high

Accesses credentials AND makes external network calls — potential credential theft

LLM02 · ASI03

Findings (2)

Coarse signal — prose, single-step high

Instruction-prose smuggling shape detected: collects a sensitive target ("Bearer token") and emits it outward ("send"). Phrased as prose with no trigger tokens — a semantic prompt-injection / data-exfil pattern the syntactic scanners can't see. Final tier capped at Caution; review the instructions before installing.

SKILL.md · | Problem | Likely Cause | Fix | |---|---|---| | `401 Invalid or expired API token` | Missing/incorrect Bearer token | Regenerate token at `https://lovelybots.c

Pattern match low

References tunneling service

PUBLISH.md · prose · downgraded · ngrok

Permissions & capabilities

Requires 1 environment variable. (1 sensitive: LOVELYBOTS_API_KEY). Requires 2 system binaries. (1 elevated: curl).

network_outcredential_access

I installed anyway

Check another skill Browse the registry Auditing your own skills or configs? Use the API