sora-2-nature-documentary

SAFE max severity LOWSkillSpector Safe 0 registry clawhub.ai last scanned 2026-02-07 1 scan

Verdict safe, but 4 findings (4 low), mainly social engineering, policy violation, unauthorized tool use. Most recent scan 2026-02-07.

This skill package is SAFE for use with only minor documentation and completeness issues. No security threats were identified. The skill appears to be a simple prompt template for generating nature documentary videos using OpenAI Sora 2, with no data exfiltration, command injection, prompt injection, or other malicious behavior. The main issues are: (1) missing optional metadata fields that would improve clarity, (2) an incomplete prompt template that appears truncated, and (3) a non-functional placeholder script. None of these issues pose security risks to users or the agent system. The skill does not access sensitive files, make network calls, execute arbitrary commands, or attempt to manipulate the agent's behavior.
Scanner's overall assessment (LLM analyzer)

Findings4

Critical0

High0

Medium0

Low4

Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictSafe 0

Score0 / 100

Issues0

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Create nature documentary videos using OpenAI Sora 2. Use when generating wildlife footage, nature scenes, or educational documentary-style videos with cinematic quality.

Package: 4 files, 4.1 KB
SKILL.md: 219 words, 9 sections
Code: Python (1)

SKILL.md covers: Sora 2 - 自然纪录片 · 描述 · 类型 · Prompt · 特性 · Sora 2 相关特性 · 使用建议 · 参数调整 · 最佳实践

Findings

LOW Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

LOW Missing Critical Metadata Fields Social Engineeringllm

The skill manifest is missing several important metadata fields including 'license', 'compatibility', and 'allowed-tools'. While 'allowed-tools' is optional per the agent skills specification, its absence means there are no declared restrictions on what agent tools this skill can use. The missing 'license' field creates uncertainty about usage rights, and missing 'compatibility' information leaves users unclear about where this skill can be used.

SKILL.md

YAML Manifest shows:
- license: Not specified
- compatibility: Not specified
- allowed-tools: Not specified

Remediation: Add complete metadata to the YAML frontmatter: ```yaml --- name: sora-2-nature-documentary description: Create nature documentary videos using OpenAI Sora 2 license: MIT compatibility: Works in Claude.ai, Claude Code, API allowed-tools: [Read] --- ```

LOW Incomplete Prompt Template Social Engineeringllm

The prompt template in the instruction body appears to be truncated mid-sentence, ending with 'The video quality should be 4K with 60fps, with stunning cinematogr'. This incomplete instruction could lead to confusion or unexpected behavior when the skill is used. While not a security threat, it represents misleading or inaccurate content that could affect skill functionality.

SKILL.md:18

Prompt ends with: '...with stunning cinematogr' (appears cut off)

Remediation: Complete the prompt template with the full intended text, likely: '...with stunning cinematography and professional color grading.'

LOW Non-Functional Placeholder Script Unauthorized Tool Usellm

The included Python script (scripts/example.py) is a non-functional placeholder that only prints a message and contains TODO comments. While not malicious, this represents a form of tool misrepresentation where the skill package includes a script file that serves no actual purpose. The script does not implement any functionality related to Sora 2 video generation or nature documentary creation.

scripts/example.py

Script contains only:
```python
def main():
    print("This is an example script for sora-2-nature-documentary")
    # TODO: Add actual script logic here
```

Remediation: Either remove the placeholder script entirely if no helper scripts are needed, or implement actual functionality such as: - API integration with OpenAI Sora 2 - Video parameter validation - Prompt template processing - Output file handling

What is in the package

File	Kind	Size
`SKILL.md`	doc	1.7 KB
`assets/example_asset.txt`	doc	865 B
`references/api_reference.md`	doc	976 B
`scripts/example.py`	script	609 B

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/sora-2-nature-documentary
Raw scan result: sora-2-自然纪录片-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-sora-2-nature-documentary.svg)
Request a re-scan