ClawHub
Back to skill

Security audit

文章配图设计师

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent article-illustration workflow that uses image generation and local output files in ways that match its stated purpose.

Use this skill when you want the agent to generate article illustrations, not just draft ideas. It may send article-derived details to the image generator and save images, prompts, and planning notes locally, so ask it to show the plan first or avoid sensitive article content if that matters.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs the agent to proceed directly to image generation and file output without waiting for user confirmation. This creates an authorization and side-effect risk: a casually matched invocation could cause unintended tool use, cost-incurring generation, and local artifact creation without the user clearly consenting at that moment.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The fallback path writes complete prompts to local files but does not clearly warn the user in advance. Even if the prompts are not highly sensitive by default, they may contain article-derived content, internal framing, or proprietary text fragments, so silent local persistence increases confidentiality and surprise side-effect risk.

Static analysis

No suspicious patterns detected.