ClawHub
Back to skill

Security audit

QuiverAI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward QuiverAI integration for generating and vectorizing SVGs, with external API use disclosed and no hidden persistence or destructive behavior found.

Install only if you are comfortable sending SVG prompts, reference images, image URLs, or base64 image data to QuiverAI. Keep QUIVERAI_API_KEY in an environment variable or secret manager, avoid using confidential images or regulated data unless you have reviewed QuiverAI's privacy terms, and pin the SDK version if you use the npm package.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:42
Finding

Unpinned Third-Party SDK Installation Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 42
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown
Node.js SDK (`npm install @quiverai/sdk`):

Technical Analysis

The documented installation command does not specify an exact reviewed version of @quiverai/sdk. It also provides no lockfile, integrity hash, package provenance verification, or recommendation to disable npm lifecycle scripts.

Consequently, users following the instructions will install whichever package version the npm registry resolves at installation time. The installed code may therefore differ from the version present when the Skill was audited. If the package, publisher account, or package distribution process is compromised, a malicious release could execute attacker-controlled lifecycle scripts during installation or malicious runtime behavior when imported.

This finding concerns supply-chain integrity. There is no evidence in the audited file that the current package is malicious.

Attack Path

  1. An attacker compromises the npm package, its publisher account, or its release pipeline and publishes a malicious version of @quiverai/sdk.
  2. A user follows the documented npm install @quiverai/sdk instruction after the malicious version becomes the registry default.
  3. npm downloads the unreviewed version without enforcing a known version or integrity value.
  4. Malicious package lifecycle code may execute during installation, or malicious SDK code may execute when the package is imported.
  5. The code runs with the privileges of the user performing the installation or invoking the application.
  6. Accessible files, environment variables, and credentials—including QUIVERAI_API_KEY if present in that process environment—could be read or transmitted.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the privileges of ...[truncated 372 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the floating installation command with an exact, reviewed version:
    bash
    npm install --save-exact @quiverai/sdk@<reviewed-version>
  2. Commit and enforce a lockfile generated from a trusted registry so transitive dependency versions and integrity values are reproducible.
  3. Verify the package name, publisher, provenance, signatures, and published integrity metadata before recommending a release.
  4. Use npm ci in automated environments to enforce the committed lockfile rather than resolving new versions.
  5. Where compatible with the package, install with lifecycle scripts disabled:
    bash
    npm install --ignore-scripts --save-exact @quiverai/sdk@<reviewed-version>
  6. Run dependency installation and SDK execution under a non-privileged account with access only to required files and environment variables.
  7. Review and update the pinned version through a controlled dependency-update process that includes source review, vulnerability scanning, and testing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly routes user prompts and potentially user-supplied raster images to a third-party API, but it does not warn that potentially sensitive content leaves the local environment. This can cause accidental disclosure of private data, proprietary images, or regulated content because users may assume the tool is purely local.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
- Site: https://quiver.ai
- Docs: https://docs.quiver.ai
- API base: `https://api.quiver.ai/v1`
- Model: `arrow-preview`
- Auth: Bearer token via `QUIVERAI_API_KEY`
- Billing: 1 credit per request (regardless of `n`).

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
- Site: https://quiver.ai
- Docs: https://docs.quiver.ai
- API base: `https://api.quiver.ai/v1`
- Model: `arrow-preview`
- Auth: Bearer token via `QUIVERAI_API_KEY`
- Billing: 1 credit per request (regardless of `n`).

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md
- Site: https://quiver.ai
- Docs: https://docs.quiver.ai
- API base: `https://api.quiver.ai/v1`
- Model: `arrow-preview`
- Auth: Bearer token via `QUIVERAI_API_KEY`
- Billing: 1 credit per request (regardless of `n`).

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

Endpoint: POST /v1/svgs/generations

bash
curl -X POST https://api.quiver.ai/v1/svgs/generations \
  -H "Authorization: Bearer $QUIVERAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

Endpoint: POST /v1/svgs/vectorizations

bash
curl -X POST https://api.quiver.ai/v1/svgs/vectorizations \
  -H "Authorization: Bearer $QUIVERAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The documentation tells users to create and use an API key but does not include any guidance on secure secret handling. This increases the likelihood of users exposing credentials in logs, screenshots, source control, or client-side code, which could allow unauthorized API use and billing abuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.