Security audit

Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent image-generation purpose, but it sends prompts and credentials to an external service under broad triggers and accepts unsafe remote-controlled outputs.

Review before installing. Use this only if you are comfortable with matching prompts being sent to clawgirl.date using your API key, generated files being saved locally, and the service influencing returned text and image download URLs. Prefer a constrained environment and a limited API key, and avoid sending private or sensitive details through this skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:3
Finding: Agent Persona and Response-Flow Hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate.js:71
Finding: Server-Controlled URL Download Enables SSRF and Unbounded File Retrieval
Content: View full analysis
{ if (success) { console.log(`IMAGE_PATH=${localPath}`); } else { console.log(`IMAGE_URL=${data.imageUrl}`); console.log(`DOWNLOAD_FAILED=true`); } }); } ``` ```js function downloadImage(url, localPath, callback) { const protocol = url.startsWith('https') ? https : http; const dir = path.dirname(localPath); if (!fs.existsSync(dir)) { fs.mkdirSync(dir, { recursive: true }); } const request = protocol.get(url, (response) => { if (response.statusCode === 301 || response.statusCode === 302) { downloadImage(response.headers.location, localPath, callback); return; } if (response.statusCode !== 200) { callback(false); return; } const file = fs.createWriteStream(localPath); response.pipe(file); file.on('finish', () => { file.close(); callback(true); }); file.on('error', () => { fs.unlinkSync(localPath); callback(false); }); }); request.on('error', () => { callback(false); }); request.setTimeout(30000, () => { request.destroy(); callback(false); }); } ``` ### Technical Analysis The `imageUrl` value is supplied by the remote API and passed to `downloadImage` without validation. The downloader does not restrict the destination hostname, resolved IP address, port, protocol, content type, response size, or redirect count. The protocol selection ...[truncated 3147 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are broad everyday expressions such as 'photo', 'show me', and 'let me see', which can easily match benign conversation and cause the skill to run unexpectedly. Because execution sends raw user prompts to an external API and may generate media automatically, over-triggering can leak user content to a third party, consume paid API quota, and produce unwanted NSFW/parasocial outputs without clear user intent.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
1. 调用脚本：`node ./scripts/generate.js "$prompt"`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
md
1. 调用脚本：`node ./scripts/generate.js "$prompt"`

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares use of an environment secret (CLAWGIRL_API_KEY) and invokes a local script, but it does not declare an explicit tool or permission scope. That creates ambiguity about what execution and secret access the skill requires, making review and sandbox enforcement harder and increasing the risk of over-privileged execution in hosts that infer capabilities loosely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly says to pass the user's original words directly as prompt, but it does not warn that this content is transmitted to the external ClawGirl API. Users may disclose sensitive personal, sexual, or private context expecting local chat behavior, and that data would be sent off-platform without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script automatically reads CLAWGIRL_API_KEY from environment variables and from multiple local config files under the user's home directory without any clear disclosure in the file. While this is common implementation behavior, it still creates a genuine security and privacy issue in an agent skill because the skill silently discovers and uses stored secrets, expanding the chance of unintended credential use or abuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script sends both the user-provided prompt and a bearer token to a third-party service at clawgirl.date, but the file provides no user-facing disclosure, consent flow, or scoping controls. In a skill ecosystem, this is a real privacy and credential-exposure concern because prompts may contain sensitive content and the token authorizes billable or account-bound API usage on an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill requires an external API credential but does not clearly warn users or deployers about the trust boundary, billing, and data-sharing implications of using that third-party service. While the presence of an API key itself is normal, lack of disclosure can lead to uninformed deployment and misuse of paid or sensitive external integrations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The script downloads remote content and writes it into a user-controlled media directory without a prior user-facing warning in this file. Although the behavior is expected for an image-generation skill, silent filesystem writes still matter because they persist externally sourced data locally and can consume disk space or leave unwanted content on the host.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.