ClawHub
Back to skill

Security audit

Sih.AI Photo Changer

Security checks for vulnerabilities and agentic risk

Overview

This image-editing skill does what it claims at a high level, but it uploads user-selected images and prompts to an under-disclosed third-party endpoint using a hardcoded bearer token.

Review before installing. Use this only with images you are comfortable sending to the remote image-generation provider, avoid sensitive photos or confidential documents, and treat the bundled API token as exposed and needing rotation by the publisher.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/image_gen.py:13
Finding

Hard-Coded API Bearer Token Exposed in Source Code

Content
View full analysis
`. 4. If the token is active, the remote service processes those requests under the credential owner's account and applicable permissions. 5. The attacker may continue using the credential until it is revoked, expires, or is otherwise restricted. ### Impact Assessment If active, the exposed token may permit unauthorized use of the associated image-generation API account. Potential consequences include: - Consumption of the account's API quota or paid capacity. - Genera ...[truncated 434 chars]
Remediation
View remediation

other

Warning
Location
scripts/image_gen.py:12
Finding

Insufficiently Disclosed Transfer of Local Images and Prompts to a Third-Party Domain

Content
View full analysis
str: """将图片文件编码为base64格式（不带前缀，适配sihai-image-27模型）""" with open(image_path, 'rb') as f: image_data = base64.b64encode(f.read()).decode('utf-8') # sihai-image-27模型只需要纯base64，不需要data:image前缀 return image_data ``` ### Technical Analysis The Skill documentation presents the service as “Sih.AI,” while the implementation transmits images and prompts to `api.vwu.ai`. The documentation explains that local files are converted to Base64, but it does not clearly identify the actual recipient domain or provide information about its ownership, retention practices, or privacy policy. Base64 is reversible transport encoding, not encryption or anonymization. The receiving service obtains the complete original image content. The static pre-scan's encoding warning therefore identifies a real outbound data flow, but the encoding itself is not covert or independently malicious: it is documented and appears necessary for the selected API's request format. Remote transmission is inherent to cloud-based image generation and t ...[truncated 1747 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This is a significant transparency and trust violation: the skill claims to use Sih.AI, while detected behavior references a different external domain, uploads local file contents, and uses a hardcoded bearer token. That combination can conceal data exfiltration, undisclosed third-party processing, and credential exposure, all of which materially increase risk to users and operators.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill documentation indicates network-capable behavior but does not declare any explicit tool scope such as allowed network access. That weakens reviewability and increases the chance the skill can exfiltrate user-provided images or metadata to external services without clear, enforceable boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill encourages users to provide image URLs or local image files for editing, but does not clearly warn that those images are transmitted to an external API for processing. For a photo-editing skill, this is particularly sensitive because images may contain faces, documents, location data, or other personal content, so lack of disclosure can lead to unintentional privacy breaches.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/image_gen.py (reported line 12)May include surrounding context.

python
import requests
from pathlib import Path

API_URL = "https://api.vwu.ai/v1/images/generations/"
API_TOKEN = "sk-w4YfLvoXwIEM0I3uNcOOOclfHkBDiR19Md9ixabWv1XMNPhn"
DEFAULT_MODEL = "sihai-image-27"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file contains a hardcoded bearer API token directly in source code. This is dangerous because anyone with access to the repository, logs, or packaged skill can reuse the credential to invoke the third-party service, incur cost, or abuse the account, and the skill’s image-editing purpose does not require embedding a reusable secret in distributable code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

When a local file path is supplied, the code base64-encodes the entire image and sends it to an external API without any explicit user-facing disclosure, consent flow, or data-handling warning. This can expose sensitive personal images or metadata-bearing content to a third party, which is especially relevant for a skill designed to edit user photos such as face swaps and beautification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/image_gen.py (reported line 55)May include surrounding context.

python
"model": model
    }

    response = requests.post(API_URL, headers=headers, json=payload)
    response.raise_for_status()
    return response.json()

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The text says to use concise, explicit Chinese descriptions, which imposes a language preference in the skill guidance. Since no user opt-in, alternative language support, or region-specific justification is provided, this appears to be a natural-language policy issue under the language/locale rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The visible natural-language documentation and CLI examples are entirely in Chinese, with no indication that other languages are supported or that the user can choose a locale. Under the stated policy, forcing a specific language without user opt-in is a language/locale policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.