ClawHub
Back to skill

Security audit

Colormind

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Colormind palette helper with a real plaintext-HTTP privacy risk, but I found no hidden credential access, persistence, destructive behavior, or purpose-mismatched capability.

Install only if you are comfortable sending palette inputs or image-derived color values to colormind.io over unencrypted HTTP. Do not use it with sensitive images, confidential designs, proprietary brand colors, or untrusted image files unless you add sandboxing and explicit approval around the image workflow.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate_palette.mjs:72
Finding

Palette and Image-Derived Color Data Transmitted over Unencrypted HTTP

Content
View full analysis
-colors 8 -unique-colors \ -format "%c\n" histogram:info:- \ | sed -E 's/^[[:space:]]+//' > "$HIST_FILE" # Parse histogram to JSON python3 "$SCRIPT_DIR/parse_histogram.py" < "$HIST_FILE" > "$SAMPLED_FILE" # Extract base RGB color BASE_RGB=$(python3 "$SCRIPT_DIR/get_base_rgb.py" "$SAMPLED_FILE") # Generate Colormind palette node "$SCRIPT_DIR/generate_palette.mjs" --model "$MODEL" \ --input "$BASE_RGB" N N N N > "$COLORMIND_FILE" ``` ### Technical Analysis The scripts communicate with the Colormind service using plain HTTP. HTTP does not provide transport encryption, endpoint authentication, or response integrity. Consequently, any party capable of observing or modifying traffic between the host and the API can read the submitted model and RGB values or alter requests and responses. The image-processing workflow extracts the dominant RGB color from a local image and forwards that value to `generate_palette.mjs`. Although the complete image is not uploaded, the derived color information may still be sensitive when it represents proprietary branding, private designs, documents, or other confidential visual material. The model-list request does not transmit image data, but its response can still be modified in transit. The generated palette r ...[truncated 1905 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 21)May include surrounding context.

md
## What It Does NOT Do

- ❌ Download or execute external code
- ❌ Access credentials or environment variables
- ❌ Write outside the workspace
- ❌ Make network calls except to colormind.io API
- ❌ Execute user-provided code

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared purpose centers on interacting with the Colormind.io API to list models and generate color palettes. The actual code chunk is a simple utility that merges two JSON inputs from local files into a combined structure. This is materially different from the described primary purpose and introduces a local file-processing capability not mentioned in the description. Therefore, the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description is about interacting with the Colormind.io API to list models and generate color palettes. The supplied code does not perform any network/API interaction or palette generation. Its sole function is to read a local JSON file and extract the first RGB entry. This is a materially different primary purpose from the declared behavior, so it is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is about interacting with the Colormind.io API to generate palettes and color suggestions. The supplied code does something materially different: it reads histogram output text, parses color/count entries, sorts them, and emits JSON. There is no network access, no API calls, no model listing, and no palette generation logic. This is a clear description-behavior mismatch with a different primary purpose.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill documentation advertises file-reading and network-capable behavior but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, that weakens least-privilege controls and can allow the skill to access local files and make outbound requests without transparent review, which is especially relevant here because the skill explicitly sends data to an external service over unencrypted HTTP.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The script transmits user-supplied palette/model data to an external service over plain HTTP, which provides no transport encryption or server authentication. This allows a network attacker to intercept or modify requests and responses, potentially exposing user data and causing the tool to print attacker-controlled palette output.

Content

Scanner excerpt · scripts/generate_palette.mjs (reported line 72)May include surrounding context.

js
body.input = inputSlots.map(parseSlot);
}

const resp = await fetch("http://colormind.io/api/", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify(body),

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script derives a base RGB value from a user-supplied image and then sends that derived data to the external Colormind API without any explicit notice, consent prompt, or offline-only option. Even though it does not upload the full image, image-derived data can still reveal user content characteristics, and silent network transmission creates a privacy and data-handling risk in environments that expect purely local processing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.