ClawHub
Back to skill

Security audit

image2生图助手

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed external AI image/prompt workflow, but users should avoid sending confidential or sensitive brand assets unless that third-party processing is acceptable.

Install only if you are comfortable sending the supplied prompts, image files, reference URLs, and related business context to ai-skills.ai using your AISKILLS_API_KEY. Do not submit private customer data, unreleased campaign material, confidential brand assets, personal images, regulated data, or unlicensed content unless your organization has approved that data flow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documentation instructs users to provide publicly accessible image or material URLs and other reference content, but does not warn that these materials may contain sensitive, proprietary, or personal data that will be sent to a third-party service. In this context, the risk is elevated because the skill is explicitly used for marketing, ecommerce, and brand assets, which often include unreleased campaign materials and licensed content.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly encourages users to provide accessible URLs and upload reference files, including product images, brand materials, and other potentially sensitive assets, without warning against confidential, private, licensed, or personal data. In a workflow that sends these materials to an external API, this omission can lead to unintended disclosure of proprietary or personal information.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The documentation states that runner parameters are sent to the AI Skills API, but it does not clearly warn users that all provided text, links, and files leave the local environment and are transmitted to a third-party service. This increases the risk of accidental exfiltration of sensitive business, customer, or copyrighted content through normal use.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill accepts public URLs and uploaded image files but does not warn users that these materials may be sent to the backend or model provider for processing. In a marketing/ecommerce context, users may upload unpublished creative assets, product imagery, or licensed materials, creating confidentiality, privacy, and third-party data transfer risk without informed consent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.