ClawHub
Back to skill

Security audit

Image Generation Agent

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed remote image-generation skill with ordinary privacy and supply-chain cautions, not evidence of hidden or destructive behavior.

Install only if you are comfortable sending prompts and any reference images to AgentPMT's hosted service. Avoid sensitive or regulated images unless your organization approves that use, and prefer pinned or reviewed install paths for companion skills instead of running mutable npx examples blindly.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:237
Finding

Unpinned Third-Party CLI and Skill Repository Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 237–250
Vulnerability Type: Supply-chain exposure through mutable, unpinned dependencies
Risk Level: Medium

Vulnerable Code

markdown
Core AgentPMT setup skills:
- What AgentPMT is: ../what-is-agentpmt
  - ClawHub page: https://clawhub.ai/agentpmt/what-is-agentpmt
  - OpenClaw install: `openclaw skills install what-is-agentpmt`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup
  - ClawHub page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup
  - OpenClaw install: `openclaw skills install agentpmt-account-mcp-rest-api-setup`
  - skills.sh install: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`

skills.sh install script:

```bash
npx skills add AgentPMT/agent-skills --skill what-is-agentpmt
npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup
text

Equivalent unpinned installation recommendations also appear at `SKILL.md:154` and `SKILL.md:321-322`.

### Technical Analysis

The documented setup process invokes the `skills` CLI through `npx` without pinning a reviewed package version and downloads skills from `AgentPMT/agent-skills` without specifying an immutable commit or verified artifact digest.

Consequently, the effective dependencies installed by these commands can change after this Skill has been audited. An npm package takeover, compromised publisher account, malicious package-version update, repository compromise, or unauthorized modification of the repository's default branch could cause later users to retrieve content different from the reviewed content.

Running a mutable package through `npx` is particularly sensitive because npm package lifecycle behavior and the invoked CLI execute with the operating-system privileges of the user run
...[truncated 1958 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills npm package to a reviewed exact version rather than allowing npx to resolve the latest release:
    bash
    npx --yes skills@<reviewed-exact-version> add AgentPMT/agent-skills --skill what-is-agentpmt
  2. Pin AgentPMT/agent-skills to an immutable commit SHA or signed release tag supported by the installer.
  3. Publish expected integrity hashes for downloaded archives and verify them before installation.
  4. Require signed releases and enforce protected branches, mandatory review, and multi-factor authentication for dependency publishers.
  5. Use a lockfile, internal package mirror, or approved artifact registry so production installation does not depend on mutable upstream state.
  6. Avoid running installation commands with administrator or root privileges. Execute them in a sandbox with restricted filesystem, credential, and network access.
  7. Review downloaded Skill files before activation and require explicit user approval before installing additional companion skills.
  8. Document the exact dependency versions and repository revisions included in each audited Skill release.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The activation keywords include broad terms like 'prompt' and 'aspect ratio' that can appear in many ordinary user requests unrelated to this specific tool. In agentic environments, overly generic triggers can cause accidental tool selection and unintentional transmission of user content to a paid external service, increasing privacy and cost risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 324)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/image-generation-agent
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 325)May include surrounding context.

md
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/image-generation-agent
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The schema allows reference images to be supplied via public URLs, file IDs, or base64 image data, but the skill documentation does not clearly warn users that these inputs will be transmitted to an external image-generation service for processing. This creates a privacy and data-handling risk because users may provide sensitive or proprietary images without understanding they are being sent off-platform or to a third-party model provider.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.