ClawHub
Back to skill

Security audit

Ad Designer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent ad-image generator, but it recommends unsafe shell-based installation and command execution patterns that users should review before installing.

Install only if you are comfortable reviewing the uv installation path yourself and ensuring generated prompts and filenames are passed to the image script safely, preferably through argument arrays or robust escaping rather than a pasted shell command.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:29
Finding

Unverified Remote Installer Downloaded and Executed Through a Shell

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:143
Finding

Shell Command Injection Risk Through Untrusted Prompt Interpolation

Content
View full analysis
" \ --filename "/tmp/marketing/assets/images/--draft.png" \ --resolution 1K ``` ### Technical Analysis The constructed prompt can incorporate content obtained from a creative brief, campaign-plan file, brand bible, or conversation. These are externally controlled data sources. The command template places that content directly inside a quoted shell argument but does not require escaping, validation, or use of a shell-free process API. Double quotes do not neutralize every shell metacharacter. If an Agent materializes this template and executes it through a shell, prompt content containing a closing quote can escape the intended argument. Shell substitutions such as `$(...)` and backticks may also be evaluated within double quotes. Consequently, malicious campaign or brand content could transform an image-generation request into arbitrary local shell commands. The same concern can apply to `` if a generated filename is not strictly normalized as required. The document calls for lowercase kebab-case but does not provide an enforceable validation mechanism. This is an instruction-level command template rather than an included executable implementation. Exploitation therefore depends on the Agent rendering attacker-controlled values into a command string and passing that string to a shell. The Skill nevertheless explicitly promotes that execution pattern without mandatory safeguards. ### Attack Path 1. An attacker supplies or modifies a campaign brief, brand-bible file, campaign-plan JSON, or inline conversation content. 2. The malicious content is selected for inclusion in the constructed image prompt. 3. ...[truncated 1259 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

Step 5: Generate Images

Create the output directory:

bash
mkdir -p /tmp/marketing/assets/images

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The skill instructs users to install uv by piping a remote script directly into sh. This is dangerous because it executes network-fetched code without verification, so a compromised upstream server, MITM position, or substituted installer could lead to arbitrary code execution on the user's machine.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

test -f ~/.codex/skills/nano-banana-pro/scripts/generate_image.py

text

If `uv` is missing: tell the user to install it with `curl -LsSf https://astral.sh/uv/install.sh | sh`.
If `GEMINI_API_KEY` is unset: tell the user to export it from Google AI Studio.
If the script is missing: tell the user the nano-banana-pro skill must be installed first.

External Script Fetching

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The error-handling section repeats the same unsafe pattern of executing a remote installer script via curl piped to sh. Repetition increases the chance that users will follow the instruction, again exposing them to arbitrary code execution if the fetched content is malicious or tampered with.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

md
| `Error loading input image:` | Verify the `--input-image` path exists; fix path and retry |
| `quota / 403 / permission` API error | Wrong key or quota exceeded; ask user to check Google AI Studio quota |
| Script not found at `~/.codex/skills/...` | nano-banana-pro skill is not installed; tell user to install it from ClawHub |
| `uv: command not found` | Run `curl -LsSf https://astral.sh/uv/install.sh | sh` then retry |
| Image generation returns blank/empty | Prompt may be too restrictive; remove avoid clauses and simplify to subject + style only |

---

Static analysis

No suspicious patterns detected.