ClawHub
Back to skill

Security audit

Pollinations Image Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Pollinations image generator, but its shell script has unsafe code-execution and API-key disclosure risks that users should review before installing.

Install only if you are comfortable reviewing or fixing the shell script first. Avoid putting sensitive prompts in it, do not run it with untrusted arguments or config files, and do not run the config command with a real API key until the key-printing issue is fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
generate.sh:291
Finding

Shell Command Injection Through Dynamic curl Command Evaluation

Content
View full analysis
Remediation
View remediation
&2 exit 1 fi ``` Apply additional input validation: - Require `seed` to match an explicitly supported numeric format. - Restrict custom filenames to a conservative character allowlist and an expected image extension. - Validate or normalize `OUTPUT_DIR` before use. - Treat API keys and all environment-derived values as untrusted shell data. - Keep every variable expansion quoted. - Consider using Bash arrays if the script is intentionally migrated from POSIX `sh` to Bash. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
generate.sh:22
Finding

User Configuration File Is Executed as Shell Code

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
generate.sh:184
Finding

Configuration Command Discloses the Pollinations API Key

Content
View full analysis
/dev/null || echo " (unknown model)" } ``` ### Technical Analysis The first parameter expansion: ```sh ${API_KEY:+✅ configured} ``` prints a configured-status message when the key is present. However, it is immediately followed by: ```sh ${API_KEY:-❌ not set} ``` When `API_KEY` is set and non-empty, the second expansion evaluates to the actual API-key value. The resulting output therefore contains both the status message and the complete secret. This output may be retained in Agent conversations, terminal scrollback, CI logs, support diagnostics, screenshots, or other command-capture systems. ### Attack Path 1. A user configures `POLLINATIONS_API_KEY`. 2. The user or an automated Agent invokes `./generate.sh config`. 3. `cmd_config` expands `API_KEY` directly into standard output. 4. The complete credential is captured by a terminal observer, transcript, log collector, or other output consumer. 5. A party with access to that output can reuse the credential against the Pollinations service. ### Impact Assessment Disclosure exposes the full Pollinations API credential. A recipient may be able to: - Perform API requests as the credential owner - Consume available pollen credits or quota - Cause unexpected service costs or exhaustion - Associate unauthorized activity with the credential owner The direct scope is the Pollinations account and any permissions granted to that API key. Broad ...[truncated 105 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
cd pollinations-image/

# 2. (Optional) Configure your API key
cp .env.example .env
# Edit .env and add your key from https://enter.pollinations.ai

# 3. (Optional) Set your default model

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
cd pollinations-image/

# 2. (Optional) Configure your API key
cp .env.example .env
# Edit .env and add your key from https://enter.pollinations.ai

# 3. (Optional) Set your default model

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md
cd pollinations-image/

# 2. (Optional) Configure your API key
cp .env.example .env
# Edit .env and add your key from https://enter.pollinations.ai

# 3. (Optional) Set your default model

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

md
cd pollinations-image/

# 2. (Optional) Configure your API key
cp .env.example .env
# Edit .env and add your key from https://enter.pollinations.ai

# 3. (Optional) Set your default model

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md
- ✅ `SKILL.md` — Documentation

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generate.sh (reported line 16)May include surrounding context.

sh
# Check for first-time setup
FIRST_RUN=false
if [ ! -f "$SCRIPT_DIR/.env" ] && [ ! -f "$SCRIPT_DIR/.user.conf" ]; then
    FIRST_RUN=true
fi

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generate.sh (reported line 73)May include surrounding context.

sh
# Check for first-time setup
FIRST_RUN=false
if [ ! -f "$SCRIPT_DIR/.env" ] && [ ! -f "$SCRIPT_DIR/.user.conf" ]; then
    FIRST_RUN=true
fi

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · generate.sh (reported line 74)May include surrounding context.

sh
# Check for first-time setup
FIRST_RUN=false
if [ ! -f "$SCRIPT_DIR/.env" ] && [ ! -f "$SCRIPT_DIR/.user.conf" ]; then
    FIRST_RUN=true
fi

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script directly sources .user.conf with the shell '.' operator, which executes arbitrary shell code rather than parsing a constrained config format. If an attacker can modify that file, or if the file is supplied from an untrusted source, they gain code execution in the user's context whenever the script runs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

The environment loader uses eval on variable names derived from file contents, so a malicious key can trigger shell expansion or command execution. Although the value is exported rather than eval'd directly, the key path is attacker-controlled and this turns a data file into executable input.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation promotes image generation through Pollinations.ai but does not clearly warn users that their prompts and generation parameters are transmitted to an external third-party service. Users may unknowingly submit sensitive, personal, or proprietary text prompts, creating a privacy and data-handling risk even if no malicious behavior is evident.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This code URL-encodes the user prompt, builds a request to https://gen.pollinations.ai, and downloads the result via curl. Although the script prints generation details, it does not clearly disclose that the prompt content is transmitted to an external service, which is a user-data/privacy-relevant network operation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.