ClawHub
Back to skill

Security audit

投前 AI 图检测 Detect Task

Security checks for vulnerabilities and agentic risk

Overview

The skill reviews product images, but its optional rerun helper can upload images to a cloud provider other than the one you selected.

Review the provider-routing defect before using automatic reruns with confidential images. The helper's --provider flag alone does not constrain its review stage; use direct review calls or consistently configure PROVIDER for the entire process. Check the destination with a dry run, limit paid reruns, preserve previous reports, and retain human review. Treat image-read errors as failures even when the checker exits successfully.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

Both the description and code concern image quality, but their assessment targets and remediation workflows materially differ. The code applies objective platform rules and explicitly defers model-dependent visual judgments to another component or a human. No realism model invocation, prompt correction generation, or iterative rerun loop appears in the supplied chunk. Its optional repair mode instead flattens transparency, replaces background pixels, crops or pads, upscales, and compresses images into local JPEG outputs. No network access or unrelated data collection is evident.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md
node scripts/gen.mjs --task detect-task \

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md
| 统一入口的全部选项 | `node scripts/gen.mjs --help` |

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, network.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
| 输入：待检图 |
| --- |
| <img src="https://raw.githubusercontent.com/dlazy-ai/ecommerce-skills/main/docs/detect-task/candidate.jpg" width="280"> |
| `candidate.jpg` — 由 [flat-lay](https://github.com/dlazy-ai/ecommerce-skills/blob/main/skills/flat-lay/skill.md) 生成的军绿毛衣模特上身图，1024×1536 |

实际执行的命令：

The image-review workflow transmits user images to an external service without a privacy warning.

Medium
Category
Output Handling
Confidence
97% confidence
Finding

The workflow sends selected images to an external model service without explaining the privacy implications or requiring authorization for sensitive material. This transfer serves the advertised task rather than constituting covert exfiltration, but unpublished products, identifiable people, or confidential image content could leave the user's approved environment.

Content

No source excerpt is available for this finding.

The batch workflow silently overwrites the existing rerun queue and reports.

Medium
Category
Output Handling
Confidence
98% confidence
Finding

The batch example truncates the existing rerun queue before processing and overwrites reports with matching SKU names. Repeated runs can therefore discard prior review state, and a failed request can replace a usable report with empty output; the impact is limited to the workflow's local generated artifacts.

Content

No source excerpt is available for this finding.

The mandatory report template forces Chinese responses and English correction sentences without user opt-in.

Medium
Category
Output Handling
Confidence
99% confidence
Finding

The template explicitly requires all report content to be in Chinese except for correction sentences, which must be English. These language requirements are reinforced elsewhere in the skill, but no language choice or locale-specific justification is provided.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Read failures produce a success exit code despite the documented error-exit contract.

Medium
Category
Excessive Agency
Confidence
99% confidence
Finding

Image-read exceptions produce reports with verdict "error", but the final exit-code check only detects "reject-risk", so unreadable inputs can yield exit status 0 despite never being validated. In this pre-listing quality gate, downstream automation that relies on the exit code could treat corrupt, unsupported, or missing images as successfully checked; the explicit error in the report limits the risk for consumers that inspect report contents.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/providers.mjs (reported line 134)May include surrounding context.

js
model: () => env.GEN_MODEL_OPENAI || 'gpt-image-1',
  describe(req) {
    const ep = req.images?.length ? 'images/edits' : 'images/generations'
    return `POST https://api.openai.com/v1/${ep}  model=${openai.model()} size=${mapSize(req.size)} n=${req.batch}`
  },
  async run(req) {
    const key = env.OPENAI_API_KEY

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/providers.mjs (reported line 153)May include surrounding context.

js
: await readFile(p)
        fd.append('image[]', new Blob([buf], { type: mimeOf(p) }), path.basename(p))
      }
      r = await fetch('https://api.openai.com/v1/images/edits', {
        method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/providers.mjs (reported line 153)May include surrounding context.

js
: await readFile(p)
        fd.append('image[]', new Blob([buf], { type: mimeOf(p) }), path.basename(p))
      }
      r = await fetch('https://api.openai.com/v1/images/edits', {
        method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/providers.mjs (reported line 157)May include surrounding context.

js
method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {
      r = await fetch('https://api.openai.com/v1/images/generations', {
        method: 'POST',
        headers: { authorization: `Bearer ${key}`, 'content-type': 'application/json' },
        body: JSON.stringify({

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/providers.mjs (reported line 157)May include surrounding context.

js
method: 'POST', headers: { authorization: `Bearer ${key}` }, body: fd,
      })
    } else {
      r = await fetch('https://api.openai.com/v1/images/generations', {
        method: 'POST',
        headers: { authorization: `Bearer ${key}`, 'content-type': 'application/json' },
        body: JSON.stringify({

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/providers.mjs (reported line 261)May include surrounding context.

js
model: (req) =>
    env.GEN_MODEL_REPLICATE ||
    (req?.images?.length ? 'black-forest-labs/flux-kontext-pro' : 'black-forest-labs/flux-dev'),
  describe(req) { return `POST https://api.replicate.com/v1/models/${replicate.model(req)}/predictions` },
  async run(req) {
    const input = { prompt: req.prompt, num_outputs: req.batch }
    if (req.images?.length) input.input_image = await asDataUri(req.images[0])

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/lib/providers.mjs (reported line 266)May include surrounding context.

js
const input = { prompt: req.prompt, num_outputs: req.batch }
    if (req.images?.length) input.input_image = await asDataUri(req.images[0])
    const j = await postJson(
      `https://api.replicate.com/v1/models/${replicate.model(req)}/predictions`,
      { input },
      { authorization: `Bearer ${env.REPLICATE_API_TOKEN}`, prefer: 'wait' },
      req.timeoutMs,

The quality-check prompt mandates Chinese reports and English correction text without user language opt-in.

Medium
Category
Output Handling
Confidence
98% confidence
Finding

Line 207 explicitly requires all report content to be in Chinese except the correction prompts, which line 215 requires in English. These language requirements are unconditional, with no user choice or region-specific justification.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/lib/providers.mjs:104

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/run_loop.mjs:61

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/gen.mjs:118

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/lib/providers.mjs:21