ClawHub
Back to skill

Security audit

SMTools Image Generation Skill

Security checks across malware telemetry and agentic risk

Overview

This is a coherent image-generation skill that uses disclosed third-party AI providers, with normal privacy and API-key cautions.

Install only if you are comfortable sending prompts, and any images you choose to edit, to the selected external provider. Use revocable API keys with spending limits, avoid sensitive prompts or private images, and prefer the default output directory or a safe explicit output path.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

Tainted flow: 'result_url' from requests.post (line 82, network input) → requests.get (network output)

Medium
Category
Data Flow
Content
output_path.parent.mkdir(parents=True, exist_ok=True)

        img_response = requests.get(result_url, timeout=60)
        img_response.raise_for_status()

        with open(output_path, "wb") as f:
Confidence
92% confidence
Finding
img_response = requests.get(result_url, timeout=60)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill declares environment requirements and instructs execution of scripts that read files and make network calls, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: users or orchestrators may invoke a capability-bearing skill without being clearly warned that it can access local image files and transmit prompts or images to third-party services.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The README states the skill activates automatically for generic image-generation requests such as 'draw' or 'generate an image,' which is broad enough to catch ordinary user requests without clearly signaling that third-party APIs may be invoked. In an agent setting, overly broad activation can cause unintended data disclosure because user prompts or referenced image inputs may be sent externally when the user did not explicitly choose this skill or provider.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README describes external providers and API keys but does not clearly warn that prompts, and potentially input images for edit operations, are transmitted to third-party services. This omission is risky because users may provide sensitive text or images without understanding they are leaving the local environment and being processed under external providers' policies.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The top-level description and activation guidance are broad enough to match many ordinary requests involving creating or modifying images. Over-broad routing increases the chance this skill is auto-invoked in contexts where the user did not intend external transmission of content or where a safer/local alternative should have been used.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The 'When to Activate' section uses high-collision verbs like generate, create, draw, and edit without scope limits, provider disclosure, or disambiguation. In an agent setting, this can misroute benign conversational requests or sensitive image-editing tasks into a workflow that reads local files and sends data off-box to third parties.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill does not clearly warn that text prompts and especially input images may be transmitted to OpenRouter, Kie.ai, or YandexART. This is a meaningful privacy and data-handling issue because users may provide sensitive prompts or local image files without realizing they will leave the local environment and be processed by external vendors.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The provider writes generated image bytes to an arbitrary filesystem path when output_path is supplied, with no validation or restriction to a safe base directory. If an attacker can influence output_path, this can overwrite files the process can access, causing data loss or unsafe file placement on the host system.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
User prompts are transmitted to Yandex's external image-generation API, which may include sensitive or regulated data, but the code shows no consent flow, warning, minimization, or privacy controls. In an agent skill, users may not realize their text is leaving the local environment and being handled by a third party.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The setup script creates a .env file specifically for API keys and instructs the user to populate it, but it does not warn that the file stores secrets in plaintext on disk. While this is a common developer pattern and not inherently malicious, it increases the chance that credentials are left unprotected, copied into backups, or accidentally committed to source control.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
Confidence
97% confidence
Finding
requests>=2.28.0

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
94% confidence
Finding
requests

VirusTotal

51/51 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.