ClawHub
Back to skill

Security audit

infinimo-ai-design-image-create

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Infinimo image-generation helper that sends prompts, optional user-selected images, and an API token to the documented service.

Install only if you are comfortable using Infinimo/clawec.com for image generation. Store the token as INFINIMO_TOKEN or INFINIMO_API_KEY, upload only images you intend to send to the service, and review the service's remote logs or deletion controls for generated content.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs the agent to execute shell scripts and curl commands, but the metadata does not declare corresponding permissions. This can bypass a caller's expectations and security controls, especially because the skill also handles authentication tokens and file uploads, increasing the risk of unintended command execution or data exposure.

Static analysis

No suspicious patterns detected.