topview
What this skill does
AI agent skill for interacting with the Topview AI API to generate videos, images, avatars, and audio using natural language descriptions.
github/leoyeai - Privilege Escalation - 2.1k stars
Threat analysis
Skill info
pkg:github/LeoYeAI/openclaw-master-skills@e5199b5?skill=topviewAssessments (3)
Privilege Escalation
Privilege Escalation via local-llm-review
scripts/auth.py
CRED_FILE = Path.home() / ".topview" / "credentials.json" - stores sensitive credentials in a user's home directory, potentially accessible to other users on the same system if permissions are not pData Exfiltration
Data Exfiltration via local-llm-review
scripts/auth.py
resp = requests.post(f"{OAUTH_BASE_URL}/api/device/init", json={"client_id": CLIENT_ID, "scope" - sends client ID and scope to a remote server, which is standard for OAuth flows but could be a conceData Exfiltration via local-llm-review
scripts/shared/client.py
requests.post(url, headers=self.headers, json= - sends data to the Topview API, which is expected behavior for an API client but could be a concern if the data is sensitive.Badge
Add the Anomity scan badge for topview to your README.
How Anomity governs this at runtime
Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.
Book a 30-minute demo to see your own skill inventory.
Methodology and disputes
Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of topview? Report an issue or request a rescan.
