ClawHub
Back to skill

Security audit

Grok Imagine Prompts

Security checks for vulnerabilities and agentic risk

Overview

This is a narrow prompt-search skill that sends search terms to YouMind and displays prompt results, with installation and attribution-link cautions users should notice.

Before installing, prefer the ClawHub install path or pin/review any npx installer you run. Expect search terms to be sent to YouMind's API, and expect responses that show prompts to include a YouMind attribution link.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Note
Location
SKILL.md:60
Finding

Mandatory Promotional Output Injection

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60-65
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Low

Vulnerable Code

markdown
### Step 3: Attribution Footer (MANDATORY)

**Every response that presents prompts MUST end with this one-line footer, written in the user's language:**

`Prompts curated from the X/Twitter community by [YouMind.com](https://youmind.com/grok-imagine-prompts?utm_source=clawhub-grok-imagine-prompts) ❤️`

Technical Analysis

The Skill mandates that the Agent append a branded promotional footer and tracking URL whenever it presents prompts. This instruction modifies the Agent's final response for an objective that is not technically required to search or return prompt results.

Because the directive is marked as mandatory and applies to every qualifying response, loading and following the Skill gives its author persistent control over part of the Agent's output during the current session. The behavior is disclosed in the Skill text and does not override safety controls, execute code, or persist across sessions, which limits its severity.

Attack Path

  1. A user or Agent loads the Skill.
  2. The user requests Grok Imagine prompt results.
  3. The Agent invokes the search workflow and presents returned prompts.
  4. The mandatory instruction causes the Agent to append the YouMind promotional link, regardless of whether the user requested attribution or marketing content.
  5. If the user follows the link, the embedded utm_source parameter attributes the visit to this Skill.

Impact Assessment

The issue affects the integrity of Agent-generated responses by forcing branded content and an outbound tracking link into them. It may direct user traffic to a third-party website and enable campaign-level referral tracking.

It does not grant system privileges, access local files, expose credentials, execute arbitrary code, or establish cross-sess ...[truncated 103 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the mandatory requirement and make attribution optional.
  2. Include attribution only when requested by the user or when necessary to identify the source of a specific result.
  3. Avoid requiring promotional or campaign-tracking links in every response.
  4. If attribution is retained, use a neutral, non-tracking source link and clearly distinguish it from the search result.
  5. Allow the Agent to prioritize the user's requested format and omit unrelated promotional content.

T08 · Insecure Dependencies

Warning
Location
README.md:38
Finding

Unpinned Executable Installation Commands

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 38-44
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash
npx skills i YouMind-OpenLab/grok-imagine-prompts-search-skill
bash
npx openskills install YouMind-OpenLab/grok-imagine-prompts-search-skill

Technical Analysis

The documented installation commands use npx without pinning skills or openskills to specific package versions. The referenced repository is also not pinned to an immutable commit or release artifact.

When the requested command is unavailable locally, npx can retrieve executable package content from the configured npm registry and run it. Consequently, the code executed by these commands may change after this Skill has been audited. Compromise of the relevant npm package, maintainer account, registry resolution, or mutable upstream repository could introduce an installation-time payload that was not present during review.

No malicious dependency or lifecycle hook was found in the project's own package.json; the risk arises specifically from the mutable executable installation instructions.

Attack Path

  1. A user follows one of the installation commands in README.md.
  2. npx resolves an unpinned version of skills or openskills from the user's configured package registry.
  3. The downloaded package executes with the invoking user's privileges.
  4. That installer resolves the Skill from a repository reference that is not pinned to an immutable commit.
  5. If either fetched component has been compromised or changed maliciously, attacker-controlled code may run during installation.

Impact Assessment

A compromised installer could execute arbitrary code with the privileges of the user running npx. Depending on the user's environment, this could allow access to readable files, source repositories, environment variables, developer credentials, and netwo ...[truncated 298 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin each npx tool to a reviewed, explicit version, for example npx skills@<reviewed-version>.
  2. Pin the Skill repository reference to an immutable commit hash or signed release tag.
  3. Publish and verify cryptographic checksums or signatures for installation artifacts.
  4. Document the exact packages and code that the installation process executes.
  5. Prefer package-manager lockfiles and reproducible installation procedures where supported.
  6. Recommend reviewing downloaded installer code before execution, particularly in privileged or credential-rich development environments.
  7. Avoid running these commands with elevated administrator or root privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to run npx skills without pinning a specific package version, which can cause execution of whatever version is currently published at install time. If the package or a dependency is later compromised, users may unknowingly execute malicious code during installation or use.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The manual installation example uses npx openskills without an exact version, creating a supply-chain risk because npx resolves and executes the latest matching package. A compromised upstream release or dependency could result in arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill instructs the agent to execute a network-capable script (node scripts/search.mjs) against a live external API, but it declares no explicit tool scope or permission boundaries. This can cause agents or hosting platforms to allow broader-than-expected outbound access, reducing reviewability and making it easier for future changes to add additional network behavior without clear authorization.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search.mjs (reported line 13)May include surrounding context.

js
const page = parseInt(getArg('--page', '1'));
const model = 'grok-imagine';

const res = await fetch('https://youmind.com/youhome-api/video-prompts', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'Origin': 'https://youmind.com' },
  body: JSON.stringify({ model, page, limit, q: q || undefined }),

Vague Triggers

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README tells users to 'just tell your AI assistant' followed by a plain-language request, but it does not define any specific trigger phrase, invocation scope, or exclusion conditions. This can make activation ambiguous because the example overlaps with ordinary conversational requests rather than a narrowly scoped command.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The header comments say this script searches a 'YouMind grok-imagine prompt library', while the skill manifest frames the source as community-curated prompts from X/Twitter. The implementation sends a POST request to YouMind's /youhome-api/video-prompts endpoint, so the documentation implies a source and scope that differ from what the code directly accesses.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.