ClawHub
Back to skill

Security audit

alphashop-image

Security checks across malware telemetry and agentic risk

Overview

This is a coherent AlphaShop image-processing API wrapper, but users should understand that their configured API keys and submitted image URLs are used with AlphaShop's external service.

Install only if you trust the AlphaShop service and are comfortable configuring AlphaShop API keys for this skill. Use secret storage or untracked local configuration for the keys, monitor account usage, and submit only image URLs you are authorized to share with AlphaShop, especially for personal photos, OCR text, copyrighted material, or watermark removal.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README promotes cloud-based image processing features but does not clearly disclose that user-provided images and potentially embedded sensitive content are transmitted to an external AlphaShop service. In a skill that handles user images, this omission can cause unintended third-party data sharing and weakens informed consent and privacy expectations.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The README instructs users to place API access keys in configuration but gives no guidance on secure credential handling, such as avoiding committing secrets to source control or rotating compromised keys. This can lead to accidental credential exposure, especially when users copy example configs into shared repos or logs.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The trigger phrases are very broad and overlap with common image-editing requests such as cropping, background removal, translation, and watermark handling. This can cause the skill to activate unexpectedly and send user-supplied image URLs or related data to an external API when the user did not specifically intend to use this provider.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The documentation instructs users to submit publicly accessible image URLs to a third-party API and states that processed results are returned, but it provides no warning about privacy, retention, third-party access, or data transfer implications. In an image-processing skill, users may submit photos containing people, products, documents, or embedded sensitive text, so the lack of disclosure can lead to unintentional exposure of personal or confidential data.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The image element detection endpoint can extract OCR text from images via recText/returnCharacter, which may reveal sensitive information such as personal details, IDs, addresses, or confidential business content. Because the documentation omits any warning or usage constraints, users may unknowingly process sensitive images and expose extracted text through logs, downstream systems, or unauthorized review.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.