ClawHub
Back to skill

Security audit

grok_image_generate

Security checks for vulnerabilities and agentic risk

Overview

The skill’s image-generation purpose is coherent, but it uses broad triggers, unpinned desktop automation, and optional external sharing without clear consent boundaries.

Review this skill before installing. Use it only if you are comfortable with Grok receiving the image prompt, generated files being saved locally, and Feishu sending being available. Prefer a pinned, reviewed desktop automation tool or a safer browser download path, and require explicit user approval before saving or sending any image.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:57
Finding

Unpinned Third-Party Desktop Automation Package Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 57-63, 69-70, and 82-88
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

The skill instructs the agent to execute desktop-agent through uvx without specifying a trusted version, package hash, lockfile, or verified package source.

bash
# Get the screen dimensions
uvx desktop-agent screen size

# Move the mouse to the image position
uvx desktop-agent mouse move <x> <y>

# Right-click
uvx desktop-agent mouse right-click
bash
# Select a context-menu option and confirm it
uvx desktop-agent keyboard press down --presses 2
uvx desktop-agent keyboard press return
bash
# Complete example
uvx desktop-agent mouse move 720 400
uvx desktop-agent mouse right-click
sleep 1
uvx desktop-agent keyboard press down --presses 2
uvx desktop-agent keyboard press return
sleep 1
uvx desktop-agent keyboard press return

Technical Analysis

uvx resolves and executes a Python package in an ephemeral environment. Because the command names desktop-agent without a version constraint or integrity verification, the exact code executed can change after the skill has been reviewed. The effective dependency may be affected by an upstream package compromise, malicious package release, registry compromise, or dependency-resolution manipulation.

This risk is amplified because the dependency is intentionally used for desktop input automation. Code executed through the package runs with the permissions of the agent process and may interact with the graphical session and applications already authenticated by the user.

The audit did not find evidence that the current package is malicious. The vulnerability is the unsafe, unpinned dependency-execution mechanism.

Attack Path

  1. An attacker compromises the resolved desktop-agent package, its publishing account, its upstream dependency ...[truncated 1231 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin desktop-agent to a specifically reviewed version rather than resolving the latest available release.
  2. Use a lockfile with cryptographic hashes and require hash verification during installation.
  3. Configure uvx to use an explicitly trusted package index or an internally controlled artifact repository.
  4. Prefer a locally installed, audited implementation over downloading executable dependencies when the skill runs.
  5. Record the expected package publisher, source repository, version, and integrity digest in the skill documentation.
  6. Execute desktop automation in a sandbox with restricted filesystem and network access.
  7. Use a dedicated low-privilege account or isolated graphical session without unrelated authenticated applications.
  8. Review dependency updates before changing the pinned version and regenerate trusted hashes only after review.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases are broad enough to match ordinary requests like 'generate an image,' increasing the chance that the skill activates when the user did not intend to use this specific workflow. Because the workflow opens an external site, generates content, saves files locally, and may send them through messaging, accidental invocation can lead to unwanted actions and data handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs creating local files and sending them via Feishu/message tooling without an explicit warning or confirmation boundary. This can cause unintended persistence of generated content on disk and unintentional exfiltration or sharing of data, especially if prompts or generated images are sensitive.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The skill invokes uvx desktop-agent without pinning a specific version, so the behavior and code fetched at runtime can change unexpectedly. In an automation skill that drives mouse and keyboard actions on the host, a compromised or incompatible upstream package could lead to unintended local actions or supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This is another unpinned uvx desktop-agent invocation. Because the package is used to control desktop input, any upstream package drift or malicious update increases risk beyond a normal helper dependency.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

Referencing uvx desktop-agent without version pinning creates a supply-chain integrity gap. Since the command is part of an interactive local-control workflow, a changed package could execute unintended code or alter automation behavior on the endpoint.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The skill again relies on an unpinned remote package for desktop control. In this context, the risk is meaningful because the tool is empowered to interact with the user's desktop and dialogs, magnifying the effect of a malicious or broken update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

An unpinned uvx desktop-agent command allows runtime resolution to whatever package version is current. That undermines reproducibility and exposes the host to supply-chain attacks, especially problematic for a tool that simulates keyboard and mouse input.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This finding is valid because the skill tells operators to run uvx desktop-agent without constraining the version. A hostile or incompatible update could affect local file-save operations and other desktop interactions in ways the skill author did not intend.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The package reference is unpinned and therefore susceptible to upstream tampering or accidental breaking changes. Because this skill mixes browser automation with local desktop control, dependency integrity is important to prevent unexpected host-side behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This unversioned uvx desktop-agent invocation presents the same supply-chain and reproducibility risk as the others. In a privileged automation path involving local GUI actions, that risk is not merely theoretical.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The skill continues to depend on a floating desktop-agent package reference. A malicious update could hijack a workflow that saves files and interacts with the desktop, potentially leading to broader local compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

Because the command is not version-pinned, users may unknowingly run different code over time. That is dangerous in this skill because the dependency participates in host input automation and file handling.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This is a true positive for unpinned MCP/tool dependency usage. In context, the skill's local desktop automation capabilities make any supply-chain compromise more consequential than a passive documentation dependency.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

All user-facing instructions, triggers, and operational guidance are presented only in Chinese, which effectively forces a specific language experience. The file does not state that the skill is intended only for Chinese-speaking users or provide any opt-in or language-selection mechanism.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.