ClawHub
Back to skill

Security audit

product-photo-visuals

Security checks for vulnerabilities and agentic risk

Overview

The photo-design workflow is coherent, but it tells your agent to spend account credits without asking for approval.

Set an explicit total credit budget before generation and require approval when it would be exceeded. Upload only photos you may share with Canvora, and review its [privacy policy](https://canvora.ai/privacy), especially for personal or confidential images. The concern is spending control; the artifacts do not establish malicious intent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
## This is an MCP-path capability

Photo embedding runs through the **MCP server** (`https://api.canvora.ai/mcp`)
or the Canvora web app. The `canvora` CLI cannot send photos today — if the
user is CLI-only, say so and point them at the MCP connector or the dashboard.
Don't fake it with `--url`.

The workflow uploads user photos to Canvora without requiring a user-facing privacy disclosure.

Medium
Category
Output Handling
Confidence
94% confidence
Finding

The workflow sends user photos to an external service and obtains CDN URLs without requiring the agent to disclose that transfer or check that sharing is authorized. Although uploading photos is necessary for this skill, product shots, team headshots, and venue photos can contain confidential or personal information; requesting a design does not necessarily establish informed authorization for external storage and processing.

Content

No source excerpt is available for this finding.

The workflow directs the agent to announce charges instead of obtaining approval before paid generation.

Medium
Category
Prompt Injection
Confidence
96% confidence
Finding

The instruction explicitly substitutes announcing the cost for obtaining permission before a credit-consuming generation. If the user has not already authorized that expenditure, the agent could spend account credits without approval; confirming an agent-selected slide count does not necessarily authorize the total charge.

Content

No source excerpt is available for this finding.