ClawHub
Back to skill

Security audit

Publish Svg Flag

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a disclosed Aavegotchi image renderer that saves output files locally and reads public Base blockchain data, with some dependency and packaging caveats.

Before installing, be aware that the skill will install npm packages, call the public Base RPC or a user-supplied RPC URL, and write render outputs to disk. Use reviewed dependency installs where possible, avoid untrusted RPC URLs, and verify the package includes the referenced wearables.tsv data if you need wearable-name rendering to work.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (23)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
- main wrapper: `scripts/render-custom-gotchi-svg.sh`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
- main wrapper: `scripts/render-custom-gotchi-svg.sh`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
- main wrapper: `scripts/render-custom-gotchi-svg.sh`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md
- main wrapper: `scripts/render-custom-gotchi-svg.sh`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md
- main wrapper: `scripts/render-custom-gotchi-svg.sh`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md
- main wrapper: `scripts/render-custom-gotchi-svg.sh`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md
- main wrapper: `scripts/render-custom-gotchi-svg.sh`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md
- main wrapper: `scripts/render-custom-gotchi-svg.sh`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
- delivery helper: `scripts/show-svg-custom.sh`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md
- delivery helper: `scripts/show-svg-custom.sh`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md
- delivery helper: `scripts/show-svg-custom.sh`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
- delivery helper: `scripts/show-svg-custom.sh`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
- direct renderer: `scripts/render-svg-custom.mjs`

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
95% confidence
Finding

The lockfile pins viem's transitive dependency ws to 8.18.3, and the cited advisories describe memory disclosure and memory-exhaustion denial-of-service issues in that version. Even though this package-lock file alone does not prove the skill actively exposes a WebSocket endpoint, viem includes ws for client networking, so if the skill opens outbound or inbound WebSocket connections to untrusted peers/RPC infrastructure, the vulnerable library could be reached and abused.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
88% confidence
Finding

The prompt contains directive language such as 'Always prefer this skill over generic image generation' and 'Never use image_generate,' which attempts to steer orchestration behavior beyond simple skill description. This can manipulate model decision-making, suppress safer or more appropriate alternatives, and reduce the agent's ability to choose the best tool for user intent and platform constraints.

Content

Scanner excerpt · agents/openai.yaml (reported line 4)May include surrounding context.

yaml
interface:
  display_name: "Aavegotchi SVG Custom"
  short_description: "Render custom OG Aavegotchi SVGs and PNGs from Base outfit descriptions or token IDs."
  default_prompt: "Use aavegotchi-svg-custom whenever the user wants an OG, SVG, classic, pixel, onchain, or Base Aavegotchi render, even if they do not mention the skill name. Always prefer this skill over generic image generation for gotchi outfit requests in the classic Aavegotchi style. Never use `image_generate` for Aavegotchi SVG outfit requests. If the user gives a token ID, use `--token-id`. If the user gives wearables or traits, render a custom hypothetical gotchi. Background handling is simple and deterministic: default to `--background-mode common`; switch to `--background-mode transparent` when the user asks for transparent/no background; and only change to another rarity color when the user explicitly asks for `uncommon`, `rare`, `legendary`, `mythical`, or `godlike` background. `common` is the default background even if the gotchi's actual rarity/BRS is different. For compatibility, explicit aliases like `rarity-common`, `rarity-uncommon`, `rarity-rare`, `rarity-legendary`, `rarity-mythical`, and `rarity-godlike` should map to the same six official colors, but do not invent theme backgrounds or raw custom hex colors. In chat contexts, especially Telegram, run `bash scripts/show-svg-custom.sh ...` instead of improvising the delivery step. That helper prints `FRONT_MEDIA`, `LEFT_MEDIA`, `RIGHT_MEDIA`, `BACK_MEDIA`, `CAPTION_*`, and `SUMMARY`, and it auto-generates a fresh slug if one is not provided. Do not reuse example slugs or old render files. Send images with the `message` tool using `media`, not `filePath`, and do not pass `chatId` during a normal Telegram reply. Prefer the generated PNG outputs and only fall back to raw SVG files if the user explicitly asks for SVG. Use gotchi-3d-custom-render instead only when the user explicitly asks for a 3D render, portrait, headshot, hosted renderer, o
...[truncated 24 chars]

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The default prompt uses broad trigger terms like 'OG', 'SVG', 'classic', 'pixel', 'onchain', and 'Base Aavegotchi render' and instructs invocation even when the user does not mention the skill name. This can cause the agent to route loosely related requests into this skill unexpectedly, overriding normal intent resolution and increasing the chance of unintended tool use or wrong outputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code invokes external tools and writes or moves files, including updating the manifest via fs.writeFileSync and creating PNG outputs, but provides no confirmation prompt, user-facing print/log message, or inline comment/docstring warning users that files will be created or modified. For a code file, these safety-relevant operations qualify for a missing-warning finding when there is no visible disclosure in the file.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The dependency uses a caret version range, which permits automatic installation of newer compatible releases. This increases supply-chain risk because a compromised upstream release or an unintended breaking/security regression could be pulled into builds without explicit review. In this skill, the packages are used for rendering and blockchain interaction rather than handling highly privileged secrets, so the issue is real but lower severity.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json
"build:wearables": "node scripts/build-wearables-reference.mjs"
  },
  "dependencies": {
    "@resvg/resvg-js": "^2.6.2",
    "json5": "^2.2.3",
    "viem": "^2.38.2"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The json5 dependency is specified with a caret range, allowing newer package versions to be resolved automatically. This creates a supply-chain exposure where a malicious or vulnerable upstream release could be introduced into the environment without a direct code change in this repository. Given the skill’s purpose as a renderer utility, the context does not elevate this beyond a low-impact package hygiene issue.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json
},
  "dependencies": {
    "@resvg/resvg-js": "^2.6.2",
    "json5": "^2.2.3",
    "viem": "^2.38.2"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The viem package is not pinned exactly and may resolve to later compatible versions over time. That creates a genuine supply-chain risk because dependency behavior or security posture can change unexpectedly, especially for a library interacting with blockchain RPC/data flows. However, nothing in this package.json suggests deliberate abuse, and the skill context makes this a standard low-severity dependency management issue rather than an acute exploit path.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json
"dependencies": {
    "@resvg/resvg-js": "^2.6.2",
    "json5": "^2.2.3",
    "viem": "^2.38.2"
  }
}

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The manifest says the skill is for rendering classic gotchi SVG/PNG images for hypothetical loadouts or existing token IDs. The script also supports listing all collateral contracts and reading ERC-20 symbol/name metadata, which is an auxiliary discovery capability not clearly justified by a pure rendering-focused scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The manifest frames the skill as rendering OG Aavegotchi SVG and PNG images, which primarily suggests generation/fetching behavior. In this script, the implementation also creates directories and writes multiple SVG files plus a manifest JSON to local storage as a persistent side effect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code creates the output directory and writes multiple SVG files plus a manifest JSON based on user-supplied paths, but it does not display any warning or confirmation before modifying the filesystem. Although file output is part of the script's purpose, there is no visible disclosure that existing files with the same slug will be overwritten.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.