ClawHub
Back to skill

Security audit

Ai Image Prompts

Security checks for vulnerabilities and agentic risk

Overview

This prompt-recommendation skill is mostly coherent, but it asks agents to run shell and network update steps against mutable remote data without enough validation or containment.

Install only if you are comfortable with the skill contacting GitHub/YouMind, updating local reference files, and downloading preview images. In stricter environments, disable or review the auto-update and shell-download steps first, pin or verify the reference data source, and avoid running the media download commands with untrusted remote URLs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:161
Finding

Mandatory Promotional Output Injection

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/setup.js:56
Finding

Remote Manifest Path Traversal Allows File Writes Outside the References Directory

Content
View full analysis
c.file), 'manifest.json', '.last-updated', '.gitkeep']); if (forceMode && existsSync(refsDir)) { for (const f of readdirSync(refsDir)) { if (!validFiles.has(f)) { unlinkSync(join(refsDir, f)); console.log(` removed stale: ${f}`); } } } // Step 3: Download each category file let downloaded = 0, skipped = 0, failed = 0; for (const cat of categories) { const dest = join(refsDir, cat.file); if (!forceMode && existsSync(dest) && statSync(dest).size > 100) { skipped++; continue; } process.stdout.write(` → ${cat.file} (${cat.title}, ${cat.count} prompts) ... `); try { const text = await fetchText(`${BASE_URL}/${cat.file}`); writeFileSync(dest, text, 'utf8'); console.log('✓'); downloaded++; } catch (err) { console.log(`✗ (${err.message})`); failed++; } } ``` ### Technica ...[truncated 2874 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:247
Finding

Remote Media URL Is Interpolated into a Shell Command Without Validation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (28)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
node scripts/setup.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
node scripts/setup.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md
node scripts/setup.js

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

text
Then use the `slug` and `title` fields to match user intent to the right file.

<!-- REFERENCES_START -->

### Use Case Category Files

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs the agent to execute shell commands to download arbitrary remote media and remove local files, even though its stated purpose is recommendation. This needlessly grants code-execution and file-system behavior to a content-browsing workflow, increasing the blast radius if URLs, filenames, or instructions are manipulated.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
93% confidence
Finding

The skill prescribes a specific destructive shell action (rm /tmp/prompt_img.jpg) as part of normal operation. Even though the example path is fixed, embedding file-deletion commands in skill instructions normalizes unnecessary exec usage and can become dangerous if later generalized, templated, or combined with attacker-influenced paths.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

message tool: action=send, media=/tmp/prompt_img.jpg, caption="[Prompt Title]"

Step C — Cleanup: exec: rm /tmp/prompt_img.jpg

text

Do this for **each** of the 3 recommended prompts — one image per prompt.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · package.json (reported line 4)May include surrounding context.

json
{
  "name": "ai-image-prompts-skill",
  "version": "1.0.9",
  "description": "AI skill: 10,000+ curated image generation prompts for any model \u2014 Nano Banana Pro, Nano Banana 2, Seedream 5.0, GPT Image 1.5, Midjourney, DALL-E, Flux, Stable Diffusion, and more. Auto-downloads library on install. Works with OpenClaw, Claude Code, Cursor and more.",
  "type": "module",
  "scripts": {
    "generate": "npx tsx scripts/generate-references.ts",
    "typecheck": "tsc --noEmit",
    "setup": "node scripts/setup.js",
    "sync": "node scripts/setup.js --force"
  },
  "keywords": [
    "openclaw",
    "openclaw-skill",
    "clawhub",
    "claude-code",
    "cla

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The README instructs users to run an unpinned npx skills installer, which resolves the latest package version at execution time. If the package, dependency chain, or registry resolution is compromised, users may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This command again uses unversioned npx skills, causing users to fetch and execute whatever package version is current at the time. That creates a supply-chain risk because a compromised publish or dependency update could turn the install step into arbitrary code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The README recommends npx openskills without pinning a version, which exposes users to the same package-resolution and dependency-substitution risks as other floating npx installs. Because npx may download and run code immediately, exploitation can directly impact the local developer environment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill performs network-capable actions such as fetching prompt references and remote media, but it does not declare explicit tool scope or allowed tools. This creates a permission-boundary mismatch where a seemingly simple recommender can invoke broader capabilities than users or the host may expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The 'Use this skill when users want to' list covers very broad intents such as getting inspiration, creating illustrations, and translating prompt techniques, but it does not define clear limits or non-matching cases. In a markdown skill description, this can cause unintended activation for ordinary creative-assistance requests that may not specifically require this prompt-library skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest frames the skill as a prompt recommender, but operational instructions require downloading data from GitHub before use. This expands the trust boundary to remote content and introduces supply-chain and privacy risks that are not obvious from the declared purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill mandates silent network updates from GitHub on every run or when stale, without user-facing disclosure or consent. This can surprise users, leak request context through timing and access patterns, and expose the agent to unreviewed upstream content changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions direct downloading remote images to local temporary storage and sending them without warning the user. This expands data handling and network activity beyond what a user may reasonably expect from a prompt recommendation skill, and it creates risk from untrusted remote content.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest emphasizes recommending prompts from a curated 10,000+ prompt library. The documented workflow goes beyond recommendation by creating new AI-generated prompts and personalized remixes, which is a materially broader behavior than simply recommending library entries.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This is a manifest file, so vague-trigger review applies. The description says the skill "Auto-downloads library on install" and broadly claims it works across multiple tools, but it does not specify the exact activation context, scope, or exclusions, which can create ambiguity about when the skill performs actions or is invoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

For markdown files this rule checks omitted warnings, and for code files it checks undisclosed operations; in this manifest, the description announces automatic downloading during installation but provides no user warning about network access, data transfer implications, or that installation changes the local environment. Because install-time downloads can affect system integrity and user expectations, a clearer warning is warranted.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
82% confidence
Finding

The generate script invokes npx tsx, which can resolve and execute a package version at runtime rather than strictly using a fully pinned local binary. In environments without a locked local install or with registry tampering, this increases supply-chain risk because code fetched at execution time may differ from what the maintainer reviewed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest describes a skill for recommending and browsing curated image-generation prompts, but this script reaches out to GitHub, downloads content, deletes stale local files, and writes reference data to disk. While this may support maintaining the prompt library, it is materially broader than the end-user description of a prompt recommendation skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The README states that the skill auto-checks for updates on each use, but it does not clearly disclose the resulting network behavior, what endpoints are contacted, or what data may be transmitted. Undocumented background network access reduces user consent and trust, and could expose metadata or create an unexpected update channel.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
99% confidence
Finding

The heading narrows Step 5 to content illustration mode only, but the immediately following instructions explicitly broaden it to all users regardless of contentIllustrationMode. This is an active contradiction in the documentation about when remixing behavior should occur.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 45)May include surrounding context.

json
"author": "YouMind-OpenLab",
  "license": "MIT",
  "devDependencies": {
    "@types/node": "^20.10.0",
    "tsx": "^4.7.0",
    "typescript": "^5.3.0"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 46)May include surrounding context.

json
"license": "MIT",
  "devDependencies": {
    "@types/node": "^20.10.0",
    "tsx": "^4.7.0",
    "typescript": "^5.3.0"
  },
  "dependencies": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 47)May include surrounding context.

json
"devDependencies": {
    "@types/node": "^20.10.0",
    "tsx": "^4.7.0",
    "typescript": "^5.3.0"
  },
  "dependencies": {
    "dotenv": "^17.2.3",

Static analysis

No suspicious patterns detected.