ClawHub
Back to skill

Security audit

Runware Image & Video generation

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it sends user-provided prompts and selected media to Runware to generate or transform images and videos.

Install only if you are comfortable sending prompts, selected image files, and generation parameters to Runware. Use RUNWARE_API_KEY instead of passing the key on the command line, avoid sensitive local images unless you intend to upload them, and monitor output paths and generation costs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/image.py:222
Finding

API Credentials Can Be Exposed Through Command-Line Arguments

Content
View full analysis
`. 2. The complete command is retained in shell history, process metadata, an automation log, or a monitoring system. 3. Another local user or a party with access to those records extracts the API key. 4. The attacker submits authenticated requests to Runware using the stolen credential. 5. The attacker may consume paid generation re ...[truncated 420 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/image.py:54
Finding

API-Provided Media URLs Are Downloaded Without Destination or Size Validation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The code is narrowly focused on image tasks. It defines commands for generate (text-to-image), img2img (image-to-image), upscale, and models. All API tasks sent are either 'imageInference' or 'imageUpscale', and outputs handled are image URLs downloaded to files. There is no command, request type, argument set, or output handling for video generation. Although the description mentions videos, Kling AI, and broader top-model access, none of that functionality appears in this code chunk. The image-related portions of the description are accurate, but the claimed video capabilities are materially overstated relative to the actual implementation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code does match part of the description: it uses the Runware API for text-to-video and image-to-video generation, including Kling-related models. However, the declared purpose presents the skill as a general image-and-video generation tool with text-to-image, image-to-image, upscaling, and AI image transformation capabilities. This specific code chunk does not implement those image features; it is focused on video generation only. There are no suspicious undeclared behaviors beyond expected network calls to Runware and downloading the output video. Because the declared description materially overstates the implemented capabilities in this chunk, this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documentation indicates use of environment variables and outbound network access to the Runware API, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, missing scope declarations can cause overbroad execution privileges, making secret access and network use less transparent and harder to constrain or audit.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/image.py (reported line 19)May include surrounding context.

python
def api_request(api_key: str, tasks: list, timeout: int = 180) -> dict:
    """Send request to Runware API."""
    url = "https://api.runware.ai/v1"
    body = json.dumps(tasks).encode("utf-8")
    req = urllib.request.Request(
        url,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/video.py (reported line 20)May include surrounding context.

python
def api_request(api_key: str, tasks: list, timeout: int = 180) -> dict:
    """Send request to Runware API."""
    url = "https://api.runware.ai/v1"
    body = json.dumps(tasks).encode("utf-8")
    req = urllib.request.Request(
        url,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The img2img path accepts a local file, converts it to a data URI, and sends the image contents to the Runware API via api_request. Although the code has basic docstrings and command names, there is no clear user-facing disclosure that local image data will be uploaded to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The upscale command reads a local image file, encodes it, and sends it to the Runware API, which transmits user file contents off-system. The code does not clearly warn users in help text, comments, or runtime messaging that a local image will be uploaded to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The img2vid command reads local image files, base64-encodes them, and sends their contents to the remote Runware API. In a tool whose purpose is media generation this behavior is expected, but the lack of an explicit user-facing notice or confirmation increases the risk of unintended exfiltration of sensitive local images when users provide local paths.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.