ClawHub
Back to skill

Security audit

ImageRouter

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only skill for using ImageRouter's image API; its network calls, API key use, and optional image uploads are expected for that purpose, though users should be careful with private images and returned download URLs.

Install only if you intend to use ImageRouter and are comfortable sending prompts, selected local images, masks, and your API-authenticated requests to that service. Avoid uploading confidential images unless you accept the provider's handling of them, strip metadata when appropriate, and validate returned image URLs before using the direct download pipeline.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Chaining Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

Piping a remotely supplied URL from API output directly into xargs curl creates an unsafe command chain that blindly fetches whatever URL the service returns. If the upstream service is compromised, malicious, or manipulated, this pattern could trigger server-side request forgery to internal resources, unexpected protocol handling, or retrieval of untrusted content without validation.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

-H 'Authorization: Bearer YOUR_API_KEY'
--json '{"prompt":"abstract art","model":"test/test"}'
| jq -r '.data[0].url'
| xargs curl -o output.webp

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Search available models by name:

bash
curl "https://api.imagerouter.io/v1/models?type=image&sort=date&name=gemini"

Get all available models:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

Search available models by name:

bash
curl "https://api.imagerouter.io/v1/models?type=image&sort=date&name=gemini"

Get all available models:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Search available models by name:

bash
curl "https://api.imagerouter.io/v1/models?type=image&sort=date&name=gemini"

Get all available models:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

Search available models by name:

bash
curl "https://api.imagerouter.io/v1/models?type=image&sort=date&name=gemini"

Get all available models:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

Search available models by name:

bash
curl "https://api.imagerouter.io/v1/models?type=image&sort=date&name=gemini"

Get all available models:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

Search available models by name:

bash
curl "https://api.imagerouter.io/v1/models?type=image&sort=date&name=gemini"

Get all available models:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly demonstrates uploading local files via multipart form fields such as image[]=@... and mask[]=@... to a third-party API, but it does not warn users that local images may contain sensitive content or metadata and will be transmitted off-device. In a skill context, this omission can lead users to unintentionally exfiltrate private images or masks to a remote service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This example uploads a local image file to a remote API using image[]=@..., which can transmit sensitive image contents and embedded metadata to a third party. In this skill context that is expected functionality, but it becomes a real documentation security issue because the example lacks an explicit privacy warning or safe-handling guidance.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

Image-to-Image (with input images):

bash
curl 'https://api.imagerouter.io/v1/openai/images/edits' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -F 'prompt=transform this into a watercolor painting' \
  -F 'model=test/test' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The multiple-image example encourages bulk upload of local files to a remote service, increasing the volume of potentially sensitive data disclosed in one action. The risk is amplified by the absence of a warning about privacy, metadata leakage, or third-party retention.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

Multiple images (up to 16):

bash
curl 'https://api.imagerouter.io/v1/openai/images/edits' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -F 'prompt=combine these images' \
  -F 'model=test/test' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This example uploads both an original image and a mask file to a third-party endpoint, which may reveal private image content and derived editing intent. Because the skill omits any warning that these local files leave the user's environment, the documentation creates a meaningful privacy and data exposure risk.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

With mask (some models require mask for inpainting):

bash
curl 'https://api.imagerouter.io/v1/openai/images/edits' \
  -H 'Authorization: Bearer YOUR_API_KEY' \
  -F 'prompt=fill the masked area with flowers' \
  -F 'model=test/test' \

Static analysis

No suspicious patterns detected.