ClawHub
Back to skill

Security audit

Dataify Bing Images

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Bing Images search integration that uses a Dataify API token and outbound API calls for its stated purpose.

Install this only if you are comfortable giving the skill access to a Dataify API token and allowing it to send your image search queries to Dataify. Prefer session-scoped token setup, avoid putting tokens in chat or project files, and remember that image licensing is not verified unless you explicitly use a license filter.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill instructs the agent to read an API token from the environment and make live network requests, but it does not declare those capabilities as permissions. Hidden env/network access weakens transparency and policy enforcement, making it easier for a reviewer or runtime to underestimate what the skill can access and do.

Static analysis

No suspicious patterns detected.