ClawHub
Back to skill

Security audit

AI Image Generator

Security checks across malware telemetry and agentic risk

Overview

This skill coherently generates images through YouMind, with disclosed API-key use and automatic saving to a YouMind board, but users should avoid sensitive prompts and verify the CLI package before use.

Install this only if you are comfortable using YouMind for image generation. Configure the API key outside chat, verify the @youmind-ai/cli package before global installation, and avoid sensitive or proprietary prompts because prompts and generated images may be stored on your YouMind board.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger list includes broad terms such as 'draw' and generic image-related phrases that can match ordinary conversation, causing the skill to activate unexpectedly. Because activation can lead to external API calls, prompt transmission, and automatic persistence to a YouMind board, accidental invocation creates privacy and consent risks rather than just usability issues.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill sends user prompts to YouMind and states that generated images are saved automatically to the user's board, but the description does not prominently warn users about that external transmission and storage behavior. This can expose sensitive prompts, proprietary ideas, or personal data without sufficiently informed consent, especially if the skill is auto-triggered.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: youmind-image-generator
description: |
  Generate AI images from text prompts — one API key for GPT Image, Gemini, Seedream, and 10+ models. No juggling subscriptions. Images saved to your YouMind knowledge board. Use when user wants to "generate image", "create image", "AI image", "text to image",
  "生成图片", "AI 生图", "画像生成", "GPT image", "Gemini image", "Seedream", "DALL-E", "Midjourney".
triggers:
  - "generate image"
Confidence
84% confidence
Finding
create image", "AI image", "text to image", "生成图片", "AI 生图", "画像生成", "GPT image", "Gemini image", "Seedream", "DALL-E", "Midjourney". triggers: - "generate image" - "create image" - "AI image"

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
80% confidence
Finding
The trigger 'create image' may conflict with a built-in 'create' command family, increasing the chance of command shadowing or unintended routing. In an agent environment, ambiguous trigger resolution can cause the wrong tool to run, which is especially problematic here because execution may install packages, call an external API, and persist data automatically.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.