ClawHub
Back to skill

Security audit

CLIProxy Media

Security checks for vulnerabilities and agentic risk

Overview

The skill is meant to analyze images and PDFs through CLIProxy, but it can send local files and prompts to any configured endpoint and broadly steers all media tasks through that route without clear consent safeguards.

Review this skill before installing if you handle private photos, scans, contracts, medical records, or financial PDFs. Use it only with a CLIProxy endpoint you trust, preferably localhost or trusted HTTPS, and avoid broad automatic use when a built-in or first-party media tool would keep data in a safer path.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tainted flow: 'req' from os.environ.get (line 205, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
96% confidence
Finding

The request endpoint is taken from an environment variable or CLI override and used directly in urllib.request.urlopen without validation, allowing exfiltration of uploaded local files and prompts to any attacker-controlled URL. In this skill, the request body can contain base64-encoded local images or PDFs, so endpoint tampering turns the tool into a data-leak channel rather than just a generic outbound request.

Content

Scanner excerpt · scripts/analyze.py (reported line 215)May include surrounding context.

python
)

    try:
        with urllib.request.urlopen(req, timeout=120) as resp:
            if stream:
                return stream_response(resp)
            else:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill invokes a remote HTTP endpoint and relies on environment configuration, but it does not declare any tool scope or permissions boundary. That omission makes the capability less transparent to users and orchestrators, increasing the chance that media files, prompts, or environment-derived settings are sent over the network without explicit review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger language is very broad and instructs the agent to use this skill for essentially all image and PDF tasks, while also discouraging built-in tools. This can cause unintended invocation and route sensitive media to a third-party proxy when a safer local or first-party tool would otherwise be used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill promotes analysis of images and PDFs via a remote proxy but does not provide a clear privacy warning that files and prompts are transmitted to an external endpoint. In the context of potentially sensitive documents, scans, and photos, this omission materially increases the risk of accidental data exfiltration and user surprise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script silently base64-encodes local files and sends them to a remote endpoint, but does not provide a strong user-facing disclosure at send time. Because this skill is specifically for analyzing images and PDFs, users may underestimate that sensitive local documents are being transmitted off-host, especially when the endpoint is configurable.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The manifest emphasizes analyzing images and PDFs as media files, but the code and CLI usage also support passing remote URLs directly as inputs. While related to media analysis, this broadens the skill from file processing into remote resource handling, which is not clearly stated in the manifest description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

Most user-facing help text, errors, comments, and docstrings are written in Dutch, while the top-level usage header is in English. This creates an inconsistent experience and can impose a specific language on users without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.