ClawHub
Back to skill

Security audit

Tmp.EUU09c2J1a

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Gemini media-generation integration with some privacy-sensitive but purpose-aligned inputs like local files, clipboard images, and temporary uploads.

Before installing, use this only with media you are comfortable sending to Gemini or temporarily uploading through the Files API. Avoid from_clipboard unless the clipboard contains the intended image, and delete uploaded files when early removal matters.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The skill documents `from_clipboard: true`, which allows the tool to read image data directly from the system clipboard. Clipboard contents are sensitive and often unrelated to the user’s current request, so enabling tool-level clipboard access expands data access beyond the manifest’s core media-generation purpose and can lead to unintended exfiltration of local user data.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: gemini-mcp
description: Generate and edit images, video, and music with Google Gemini models via MCP. Use when the user asks to generate, create, or edit images (Gemini / Nano Banana), produce a consistent set of images, compose/blend multiple images, generate a short video (text→video or image→video, via the omni model), or generate music/audio clips (via Lyria). Triggers on phrases like "generate an image of", "edit this image with Gemini", "create a set of consistent images", "make a video of", "generate a video", "generate music", "make a song/audio clip", "use Nano Banana to make", or any request to produce images, video, or music via the Gemini API. Requires the @chrischall/gemini-mcp package installed and the gemini server registered (see Setup below).
---

# gemini-mcp
Confidence
84% confidence
Finding
create a set of consistent images", "make a video of", "generate a video", "generate music", "make a song/audio clip", "use Nano Banana to make", or any request to produce images, video, or music via

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.