ClawHub
Back to skill

Security audit

Li PhotoIndexWithLLM

Security checks for vulnerabilities and agentic risk

Overview

This photo-search skill is mostly coherent, but it can send private photos to a configured non-local endpoint while still treating it as local and skipping remote-upload safeguards.

Review this before installing if you will scan personal, family, work, or document photos. Use it only with a verified loopback local endpoint such as localhost or 127.0.0.1, keep REMOTE_LLM_ENABLED=false unless you intentionally want remote analysis, protect the .env and SQLite database, and remember that the local index stores full file paths and derived photo descriptions in plaintext.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
skill.py:481
Finding

Configurable Local Endpoint Bypasses Remote Image Upload Safeguards

Content
View full analysis
dict: if self.is_remote and self.require_confirm and not self.confirmed: if not sys.stdin.isatty(): raise PermissionError( "Remote transmission requires confirmation." ) confirm = input("Continue uploading photos to the remote server? (yes/no): ") if confirm.lower() != "yes": raise PermissionError("The user rejected remote photo transmission") self.confirmed = True message = self._build_vision_message(image_path, prompt) payload = { "model": self.model, "messages": [message], "max_tokens": self.max_tokens, "stream": False, "temperature": 0.1 } response = requests.post( f"{self.endpoint}/chat/completions", headers=self.headers, json=payload, timeout=self.timeout ) def _build_vision_message(self, image_path: str, prompt: str) -> dict: with op ...[truncated 4620 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (76)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CROSS_PLATFORM.md (reported line 62)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CROSS_PLATFORM.md (reported line 68)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CROSS_PLATFORM.md (reported line 250)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CROSS_PLATFORM_VERIFICATION.md (reported line 176)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CROSS_PLATFORM_VERIFICATION.md (reported line 182)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · INDEPENDENCE.md (reported line 32)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PRIVACY.md (reported line 155)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PRIVACY.md (reported line 159)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PRIVACY.md (reported line 240)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PRIVACY.md (reported line 261)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PRIVACY.md (reported line 285)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PRIVACY_GUIDE.md (reported line 39)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PRIVACY_GUIDE.md (reported line 70)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PRIVACY_GUIDE.md (reported line 111)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PRIVACY_GUIDE.md (reported line 115)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PRIVACY_GUIDE.md (reported line 122)May include surrounding context.

md
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.py (reported line 92)May include surrounding context.

python
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.py (reported line 96)May include surrounding context.

python
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.py (reported line 128)May include surrounding context.

python
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.yaml (reported line 54)May include surrounding context.

yaml
- ✅ 所有代码都在 skill.py 内

2. **自动配置加载**
   - ✅ 自动查找主项目的 .env 文件
   - ✅ 如果找不到，使用内置默认配置
   - ✅ 不需要设置环境变量

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · PRIVACY_GUIDE.md (reported line 131)May include surrounding context.

bash
# 删除不需要的索引
rm data/photo_index.db

# 清理日志
rm logs/*.log

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · PRIVACY_GUIDE.md (reported line 164)May include surrounding context.

bash
# 删除不需要的索引
rm data/photo_index.db

# 清理日志
rm logs/*.log

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · PRIVACY_GUIDE.md (reported line 134)May include surrounding context.

rm data/photo_index.db

清理日志

rm logs/*.log

text

### 4. 使用本地模型

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation states that local or remote VL models may be used, but it does not warn that image content, derived descriptions, or metadata could be transmitted to remote services. Because the skill processes personal photos, silent remote transmission creates substantial privacy and data exposure risk, especially when used by autonomous agents on sensitive directories.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 444)May include surrounding context.

md
- 查看文档：`SKILL.md`（本文件）