ClawHub
Back to skill

Security audit

Chenyu Aigc

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its examples can send API keys and private media to a configurable endpoint and leave local image payloads in a predictable temporary file.

Review this skill before installing. Use it only with a trusted HTTPS CHENYU_BASE_URL, preferably the documented default, and a narrowly scoped Chenyu API key. Do not submit sensitive prompts, private images, videos, or audio unless you are comfortable sending them to the configured provider. If using local images, replace the fixed /tmp/payload.json example with a secure temporary file that is private and removed after upload. Treat task deletion as potentially irreversible unless the provider confirms otherwise.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:24
Finding

Unrestricted API Base URL Can Expose Bearer Credentials and User Content

Content
View full analysis
/tmp/payload.json <
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
execute-recipe.md:45
Finding

Predictable Temporary Payload File Exposes Sensitive Media and Permits Symlink Attacks

Content
View full analysis
/tmp/payload.json <
Remediation
View remediation
"$payload" <

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill clearly sends user prompts and potentially user-supplied media to an external AIGC service authenticated with an API key, but it does not warn the user that their content will be transmitted off-platform. This creates a privacy and consent risk, especially if users provide sensitive text, images, or videos under the assumption processing is local or first-party.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · execute-recipe.md (reported line 8)May include surrounding context.

Request

bash
curl -s -X POST "$CHENYU_BASE_URL/api/v1/aigc/recipes/{recipe_id}/execute" \
  -H "Authorization: Bearer $CHENYU_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · execute-recipe.md (reported line 58)May include surrounding context.

Request

bash
curl -s -X POST "$CHENYU_BASE_URL/api/v1/aigc/recipes/{recipe_id}/execute" \
  -H "Authorization: Bearer $CHENYU_API_KEY" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · execute-recipe.md (reported line 41)May include surrounding context.

When a local image needs to be sent as a data URI:

  • Do NOT inline large base64 strings directly in curl -d '...' shell arguments — this will fail due to OS/shell argument length limits before the request even reaches the API.
  • Do write the full JSON body to a temporary file, then submit with curl --data @payload.json.
bash

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file documents a DELETE operation for completed tasks, but it does not warn the user that the action is destructive or whether deleted task metadata/results can be recovered. Under the markdown-specific missing-warning criteria, behaviours affecting user data or system integrity should include a clear warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.