ClawHub
Back to skill

Security audit

Grok Imagine

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward xAI image and video generator with disclosed external API use, though users should be careful with prompts and API keys.

Before installing, understand that prompts and any supplied image URLs or local path strings are sent to xAI and generated media is written to the filename you provide. Use XAI_API_KEY or a managed secret, avoid the --api-key command-line flag, avoid sensitive prompts or private image locations, and review costs before generating videos or multiple images.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_image.py:309
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis
`, as permitted by the documented interface. 2. The complete command is retained in shell history, process metadata, terminal logs, or orchestration telemetry. 3. An attacker with access to one of those local or centralized records retrieves the API key. 4. The attacker submits authenticated requests to the xAI API using the compromised bearer credential. 5. The attacker can consume the victim's API quota and access whatever xAI API capabilities are authorized for that key until it is revoked or expires. This path requires access to command histories, process information, or captured execution logs; the code ...[truncated 626 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill uses sensitive capabilities including environment access, file read/write, and network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where the runtime or reviewers cannot easily verify that the skill only uses the minimum necessary capabilities, increasing the risk of unintended data access or exfiltration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes broad phrases like "draw," "animate," and "create image," which can cause the skill to activate in situations where the user did not clearly intend to send content to this external generation workflow. In this skill's context, accidental activation is more dangerous because prompts and possibly local images may then be transmitted to a third-party API and files may be written locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill documentation does not clearly warn users that prompts and supplied images are sent to the external xAI API. This is a real privacy and data-handling issue because users may provide confidential text or local images for editing/animation without understanding that the content leaves the local environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 25)May include surrounding context.

python
from urllib.error import HTTPError, URLError
from urllib.request import Request, urlopen

IMAGES_URL = "https://api.x.ai/v1/images/generations"
EDITS_URL = "https://api.x.ai/v1/images/edits"
VIDEOS_URL = "https://api.x.ai/v1/videos/generations"
VIDEOS_POLL_URL = "https://api.x.ai/v1/videos"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 26)May include surrounding context.

python
from urllib.error import HTTPError, URLError
from urllib.request import Request, urlopen

IMAGES_URL = "https://api.x.ai/v1/images/generations"
EDITS_URL = "https://api.x.ai/v1/images/edits"
VIDEOS_URL = "https://api.x.ai/v1/videos/generations"
VIDEOS_POLL_URL = "https://api.x.ai/v1/videos"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 27)May include surrounding context.

python
from urllib.error import HTTPError, URLError
from urllib.request import Request, urlopen

IMAGES_URL = "https://api.x.ai/v1/images/generations"
EDITS_URL = "https://api.x.ai/v1/images/edits"
VIDEOS_URL = "https://api.x.ai/v1/videos/generations"
VIDEOS_POLL_URL = "https://api.x.ai/v1/videos"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate_image.py (reported line 28)May include surrounding context.

python
from urllib.error import HTTPError, URLError
from urllib.request import Request, urlopen

IMAGES_URL = "https://api.x.ai/v1/images/generations"
EDITS_URL = "https://api.x.ai/v1/images/edits"
VIDEOS_URL = "https://api.x.ai/v1/videos/generations"
VIDEOS_POLL_URL = "https://api.x.ai/v1/videos"

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The manifest describes this skill as generating and editing images/videos, but the code also implements local credential discovery via XAI_API_KEY and ~/keys.txt. While this may be convenient for operation, reading environment variables and arbitrary local secret storage is not part of the stated media-generation purpose and is an extra capability beyond what the manifest explains.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.