ClawHub
Back to skill

Security audit

pic-gen

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill is coherent and disclosed, but users should handle API keys and dependencies carefully.

Install in an isolated environment, prefer environment variables over saving API keys in config/models.yaml, avoid sharing that config file after adding real keys, and consider pinning reviewed dependency versions before regular use.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly instructs the bot to accept API keys in chat and persist them into config/models.yaml, creating a secret-handling risk. Persisting secrets from conversational input can expose them through logs, transcripts, file sync, backups, repo commits, or later readback if access controls are weak.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
pyyaml>=6.0
banana-dev>=1.0.0
Confidence
96% confidence
Finding
The dependency is specified with a lower bound only, which allows installation of many different versions over time and undermines reproducible builds. In a security context this increases supply-chain risk because a future incompatible or compromised release could be pulled in unintentionally, and known-safe versions are not enforced.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
pyyaml>=6.0
banana-dev>=1.0.0
Confidence
98% confidence
Finding
`pyyaml>=6.0` is unpinned and the package has a history of severe deserialization-related issues, so allowing any version above a floor increases the chance of resolving to an unsafe or unreviewed release. This is especially risky in agent skills, which often process structured data from external or user-controlled sources.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
pyyaml>=6.0
banana-dev>=1.0.0
Confidence
89% confidence
Finding
`banana-dev>=1.0.0` is not pinned, so deployments may silently pick up new releases with security regressions or malicious package compromise. This creates avoidable supply-chain exposure and makes builds non-deterministic.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
91% confidence
Finding
The file permits `requests` versions that may include known vulnerable releases, and the static analysis lists multiple advisories affecting this package. Because the requirement is broad (`>=2.28.0`) rather than constrained to a patched range, environments can resolve to affected versions, potentially leading to credential leakage, TLS verification issues, or other request-handling weaknesses depending on usage.

Known Vulnerable Dependency: pyyaml — 8 advisory(ies): CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more

Critical
Category
Supply Chain
Confidence
97% confidence
Finding
The file allows installation of `pyyaml` versions with multiple serious advisories, including unsafe deserialization issues that can lead to arbitrary code execution when parsing attacker-controlled YAML. In an agent skill context, where external configuration or content may be ingested, this substantially raises the danger compared with a purely internal-only library.

Static analysis

No suspicious patterns detected.