ClawHub
Back to skill

Security audit

Colors CC

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed color and placeholder helper, but it sends image and color requests to a third-party service.

Install only if you are comfortable with generated color and placeholder requests going to colors-cc.top. Do not put secrets, private project names, customer data, or internal labels in placeholder text or URL parameters, and consider local or self-hosted assets for sensitive/internal work.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (22)

External Transmission

Medium
Category
Data Exfiltration
Content
### 1. SVG Placeholders with Animation Effects
Generate dynamic, lightweight placeholders for UI mockups with various gradient and animation effects.
- **Endpoint**: `https://api.colors-cc.top/placeholder`
- **Params**: 
  - `w`: Width in pixels (default: 800, range: 50-4000)
  - `h`: Height in pixels (default: 400, range: 50-4000)
Confidence
91% confidence
Finding
The skill instructs agents to use an external third-party endpoint for generating SVG placeholders, which can transmit user-supplied text, dimensions, palette choices, and usage metadata off-platform. Even though the stated purpose is benign, any external call creates privacy, tracking, and supply-chain risk, especially because the endpoint returns active SVG content rendered by clients.

External Transmission

Medium
Category
Data Exfiltration
Content
- `speed`: Animation duration in seconds for non-static effects (default: 10, range: 1-30)
  - `attribution`: Include branding watermark (default: true). Set to `false` or `0` to disable. When enabled, adds a subtle "colors-cc.top" watermark (15% opacity) in bottom-right corner and HTML comment for viral sharing.
- **Examples**: 
  - **Static**: `<img src="https://api.colors-cc.top/placeholder?w=1200&h=630&text=Hero+Banner&palette=%23F06292,%2364B5F6" alt="Hero">`
  - **Holographic**: `<img src="https://api.colors-cc.top/placeholder?w=800&h=400&effect=holographic&palette=%2300FF41,%2300B8FF&speed=5" alt="Holo">`
  - **Mesh**: `<img src="https://api.colors-cc.top/placeholder?w=800&h=400&effect=mesh&palette=%23FFD6A5,%23FFADAD,%23E2A0FF&speed=8" alt="Mesh">`
- **Response**: SVG image with `Cache-Control: public, max-age=31536000, immutable`
Confidence
93% confidence
Finding
This example encourages embedding remote SVG URLs directly in rendered content, causing client-side requests to a third-party service and potential disclosure of user context, IP addresses, and embedded text values. The risk is increased because the feature supports arbitrary text parameters and branding/attribution behavior, making outbound sharing part of the default workflow.

External Transmission

Medium
Category
Data Exfiltration
Content
- `attribution`: Include branding watermark (default: true). Set to `false` or `0` to disable. When enabled, adds a subtle "colors-cc.top" watermark (15% opacity) in bottom-right corner and HTML comment for viral sharing.
- **Examples**: 
  - **Static**: `<img src="https://api.colors-cc.top/placeholder?w=1200&h=630&text=Hero+Banner&palette=%23F06292,%2364B5F6" alt="Hero">`
  - **Holographic**: `<img src="https://api.colors-cc.top/placeholder?w=800&h=400&effect=holographic&palette=%2300FF41,%2300B8FF&speed=5" alt="Holo">`
  - **Mesh**: `<img src="https://api.colors-cc.top/placeholder?w=800&h=400&effect=mesh&palette=%23FFD6A5,%23FFADAD,%23E2A0FF&speed=8" alt="Mesh">`
- **Response**: SVG image with `Cache-Control: public, max-age=31536000, immutable`
Confidence
93% confidence
Finding
The provided example embeds a remote animated SVG placeholder, which constitutes external content loading and can leak request metadata to the service. Because the resource is rendered by the user's client, the trust boundary shifts to a third party and creates content integrity and privacy concerns if the endpoint changes or is compromised.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Examples**: 
  - **Static**: `<img src="https://api.colors-cc.top/placeholder?w=1200&h=630&text=Hero+Banner&palette=%23F06292,%2364B5F6" alt="Hero">`
  - **Holographic**: `<img src="https://api.colors-cc.top/placeholder?w=800&h=400&effect=holographic&palette=%2300FF41,%2300B8FF&speed=5" alt="Holo">`
  - **Mesh**: `<img src="https://api.colors-cc.top/placeholder?w=800&h=400&effect=mesh&palette=%23FFD6A5,%23FFADAD,%23E2A0FF&speed=8" alt="Mesh">`
- **Response**: SVG image with `Cache-Control: public, max-age=31536000, immutable`

### 2. Fluid Animated Placeholders (Alias)
Confidence
93% confidence
Finding
This example similarly drives outbound requests to a third-party SVG generator and may include user-controlled text or color data in the query string. Query-string transmission is especially visible in logs, browser history, and intermediary systems, which can unintentionally expose sensitive prompt-derived content.

External Transmission

Medium
Category
Data Exfiltration
Content
### 2. Fluid Animated Placeholders (Alias)
Generate dynamic SVG gradients with smooth color transitions and animations.
- **Endpoint**: `https://api.colors-cc.top/fluid-placeholder`
- **Params**: 
  - `w`, `h`, `text`, `speed`, `attribution` (same as above)
  - `palette`: Comma-separated colors — HEX, RGB, or HSL (default: random, range: 2-10 colors)
Confidence
90% confidence
Finding
The fluid-placeholder endpoint is another external service dependency that processes user-selected rendering parameters and returns remote SVG content. While the capability is legitimate, the skill normalizes outbound calls to an unaudited external domain, which is a real security concern in agent environments handling sensitive context.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Params**: 
  - `w`, `h`, `text`, `speed`, `attribution` (same as above)
  - `palette`: Comma-separated colors — HEX, RGB, or HSL (default: random, range: 2-10 colors)
- **Example**: `<img src="https://api.colors-cc.top/fluid-placeholder?w=1200&h=400&palette=%23FFD6A5,%23FFADAD,%23E2A0FF&speed=8&text=Animated+Hero" alt="Warm Gradient">`
- **Response**: Animated SVG with smooth color transitions and `Cache-Control: public, max-age=31536000, immutable`

### 3. Random Colors
Confidence
90% confidence
Finding
The example URL for the fluid placeholder embeds request parameters directly into a remote fetch path, exposing user inputs to the third-party operator and to surrounding infrastructure logs. The danger is contextual rather than overtly malicious, but in enterprise agent settings this still counts as a genuine external transmission risk.

External Transmission

Medium
Category
Data Exfiltration
Content
### 3. Random Colors
Get a random HEX and RGB color with generation timestamp.
- **Endpoint**: `GET https://api.colors-cc.top/random`
- **Returns**: `{"hex": "#A1B2C3", "rgb": "rgb(161, 178, 195)", "timestamp": "2024-03-12T10:30:00.000Z"}`
- **Example**: Fetch this endpoint when you need random colors for mock data or UI components.
Confidence
86% confidence
Finding
Calling the random color endpoint sends a network request to a third-party service, which is a smaller privacy risk because the input surface is minimal. However, it still introduces dependency, observability, and availability concerns that are unnecessary for functionality easily implemented locally.

External Transmission

Medium
Category
Data Exfiltration
Content
### 4. Curated Theme Palettes
Fetch high-quality color sets for design inspiration.
- **Endpoint**: `GET https://api.colors-cc.top/palette?theme={theme_name}`
- **Themes**: `cyberpunk`, `vaporwave`, `retro`, `monochrome`
- **Returns**: `{"theme": "cyberpunk", "colors": ["#FCEE09", "#00FF41", ...], "count": 5}`
- **Example**: `fetch('https://api.colors-cc.top/palette?theme=vaporwave')`
Confidence
88% confidence
Finding
The palette endpoint requires transmitting a theme selection to an external service and relying on its response for downstream content. Although the data sent is not highly sensitive on its own, repeated agent use can still leak usage patterns and create a supply-chain trust dependency on a third-party API.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Endpoint**: `GET https://api.colors-cc.top/palette?theme={theme_name}`
- **Themes**: `cyberpunk`, `vaporwave`, `retro`, `monochrome`
- **Returns**: `{"theme": "cyberpunk", "colors": ["#FCEE09", "#00FF41", ...], "count": 5}`
- **Example**: `fetch('https://api.colors-cc.top/palette?theme=vaporwave')`

### 5. Universal Color Converter
Stateless conversion between HEX, RGB, HSL, and CMYK formats.
Confidence
88% confidence
Finding
The example fetch call normalizes agent behavior that transmits requests to a third-party domain without any consent or minimization guidance. In environments where all outbound access is security-relevant, this is a true vulnerability because it expands data exposure and attack surface beyond the host platform.

External Transmission

Medium
Category
Data Exfiltration
Content
### 5. Universal Color Converter
Stateless conversion between HEX, RGB, HSL, and CMYK formats.
- **Endpoint**: `GET https://api.colors-cc.top/convert?hex={hex}|rgb={rgb}|hsl={hsl}|cmyk={cmyk}`
- **Params**: Provide ONE of: `hex`, `rgb`, `hsl`, or `cmyk`
- **Returns**: `{"hex": "#FF5733", "rgb": "rgb(255, 87, 51)", "hsl": "hsl(10, 100%, 60%)", "cmyk": "cmyk(0%, 66%, 80%, 0%)"}`
- **Example**: `https://api.colors-cc.top/convert?hex=%23FF5733`
Confidence
91% confidence
Finding
The color conversion endpoint accepts user-provided color values via query parameters and sends them to a third party, creating data leakage risk and a dependency for a function that can usually be performed locally. Query parameters may be logged by browsers, proxies, or servers, further widening exposure.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Endpoint**: `GET https://api.colors-cc.top/convert?hex={hex}|rgb={rgb}|hsl={hsl}|cmyk={cmyk}`
- **Params**: Provide ONE of: `hex`, `rgb`, `hsl`, or `cmyk`
- **Returns**: `{"hex": "#FF5733", "rgb": "rgb(255, 87, 51)", "hsl": "hsl(10, 100%, 60%)", "cmyk": "cmyk(0%, 66%, 80%, 0%)"}`
- **Example**: `https://api.colors-cc.top/convert?hex=%23FF5733`
- **Error**: Returns `{"error": "Invalid color format"}` with status 400 if input is invalid

### 6. CSS Color Names Directory
Confidence
91% confidence
Finding
The example URL explicitly demonstrates passing input data in the query string to an external service, reinforcing a pattern of uncontrolled data egress. Even benign color data can become sensitive if derived from private prompts, internal design systems, or user-specific content embedded into requests.

External Transmission

Medium
Category
Data Exfiltration
Content
### 6. CSS Color Names Directory
Get all standard CSS color names mapped to their HEX values (~140 colors).
- **Endpoint**: `GET https://api.colors-cc.top/all-names`
- **Returns**: `{"AliceBlue": "#F0F8FF", "AntiqueWhite": "#FAEBD7", "Tomato": "#FF6347", ...}`
- **Example**: Use this to look up named colors like 'tomato' → '#FF6347'
Confidence
82% confidence
Finding
The all-names endpoint is a read-only lookup to a third-party domain, so the immediate data exposure is limited. Still, it is an avoidable external dependency for static reference data that could be bundled locally, making this a real but lower-impact security concern.

External Transmission

Medium
Category
Data Exfiltration
Content
```html
<section class="hero">
  <!-- Animated hero banner with text -->
  <img src="https://api.colors-cc.top/placeholder?w=1200&h=600&text=Hero+Section&effect=mesh&palette=%23FFD6A5,%23FFADAD,%23E2A0FF&speed=10" alt="Hero">
</section>
<div class="features">
  <!-- Static placeholder images -->
Confidence
93% confidence
Finding
This HTML example directs clients to load a third-party generated SVG asset, which discloses client metadata and trusts remote content at render time. Because the endpoint can incorporate arbitrary text into the graphic, careless usage could leak private project names, internal labels, or user content.

External Transmission

Medium
Category
Data Exfiltration
Content
</section>
<div class="features">
  <!-- Static placeholder images -->
  <img src="https://api.colors-cc.top/placeholder?w=400&h=300&text=Feature+1&palette=%23F06292,%2364B5F6" alt="Feature 1">
  <img src="https://api.colors-cc.top/placeholder?w=400&h=300&text=Feature+2&palette=%234DB6AC,%2381C784" alt="Feature 2">
</div>
```
Confidence
92% confidence
Finding
The example continues the pattern of embedding third-party URLs as image sources, creating outbound requests and dependence on remote content integrity. In aggregate, these examples make unsafe-by-default external transmission the standard operating mode of the skill.

External Transmission

Medium
Category
Data Exfiltration
Content
<div class="features">
  <!-- Static placeholder images -->
  <img src="https://api.colors-cc.top/placeholder?w=400&h=300&text=Feature+1&palette=%23F06292,%2364B5F6" alt="Feature 1">
  <img src="https://api.colors-cc.top/placeholder?w=400&h=300&text=Feature+2&palette=%234DB6AC,%2381C784" alt="Feature 2">
</div>
```
Confidence
92% confidence
Finding
This additional image embed carries the same privacy and supply-chain concerns as the surrounding examples, including exposure of rendered parameters to the third-party service. The duplication matters because it reinforces repeated outbound access as a normal pattern for agents and users.

External Transmission

Medium
Category
Data Exfiltration
Content
### Use Case 2: Generating Mock Data with Colors
```javascript
const palette = await fetch('https://api.colors-cc.top/palette?theme=vaporwave')
  .then(r => r.json())

const mockData = palette.colors.map((color, i) => ({
Confidence
90% confidence
Finding
The JavaScript example performs an explicit fetch to a third-party palette API, operationalizing external transmission in sample code that users may copy directly. This is security-relevant because copied examples often become production behavior without review, extending trust to an external service unnecessarily.

External Transmission

Medium
Category
Data Exfiltration
Content
id: i,
  name: `Item ${i+1}`,
  color: color,
  thumbnail: `https://api.colors-cc.top/placeholder?w=200&h=200&palette=${color.replace('#', '%23')},%23000000`
}))
```
Confidence
91% confidence
Finding
This example constructs third-party placeholder URLs dynamically from palette data, which compounds external dependency and can propagate unreviewed remote content throughout an application. It also demonstrates passing transformed values into URLs, which may be safe for colors but encourages a general pattern of embedding user-derived data in external requests.

External Transmission

Medium
Category
Data Exfiltration
Content
### Use Case 3: Color Picker Component
```javascript
async function getRandomColor() {
  const res = await fetch('https://api.colors-cc.top/random')
  const data = await res.json()
  return data.hex
}
Confidence
86% confidence
Finding
Fetching a random color from a third-party endpoint is a real but low-severity external transmission issue because the operation is unnecessary and easy to implement locally. The main risks are dependency on external availability and disclosure of usage metadata rather than direct sensitive-data leakage.

External Transmission

Medium
Category
Data Exfiltration
Content
### Use Case 4: Universal Color Converter
```javascript
// Convert any color format to all formats
const result = await fetch('https://api.colors-cc.top/convert?hsl=hsl(200,50%,50%)')
  .then(r => r.json())
console.log(result.hex) // #4099BF
```
Confidence
91% confidence
Finding
The converter example sends a user-supplied color string to an external endpoint, again normalizing outbound data transfer for a trivial local computation. The broader danger is not the color itself but the precedent of routing potentially prompt-derived values to a third party through logged URLs.

External Transmission

Medium
Category
Data Exfiltration
Content
By default, all SVG placeholders include a subtle branding watermark for viral sharing. Disable it for internal tools:
```
// With attribution (default - recommended for public-facing content)
https://api.colors-cc.top/placeholder?w=800&h=400

// Without attribution (for internal use)
https://api.colors-cc.top/placeholder?w=800&h=400&attribution=false
Confidence
90% confidence
Finding
This section explicitly discusses default attribution and public-facing sharing behavior, indicating the service is designed to encourage externally visible branding and third-party loading. That makes the privacy implications more pronounced because the default path promotes network disclosure and viral propagation rather than minimizing data exposure.

External Transmission

Medium
Category
Data Exfiltration
Content
https://api.colors-cc.top/placeholder?w=800&h=400

// Without attribution (for internal use)
https://api.colors-cc.top/placeholder?w=800&h=400&attribution=false
```

### ❌ Mistake 2: Fetching SVG and Re-processing
Confidence
89% confidence
Finding
The internal-use example still points to the same third-party endpoint, so even with attribution disabled the outbound request and associated metadata leakage remain. This can mislead integrators into thinking the privacy issue is solved when only branding is removed.

External Transmission

Medium
Category
Data Exfiltration
Content
const encoded = btoa(svg)

// GOOD - Use URL directly
<img src="https://api.colors-cc.top/placeholder?w=800&h=400" alt="Direct">
```

### ❌ Mistake 3: Invalid Dimensions
Confidence
92% confidence
Finding
The 'GOOD' example recommends direct embedding of a third-party placeholder URL, which is functionally convenient but security-relevant because it delegates rendering content and request handling to an external domain. In client contexts, this exposes usage metadata and trusts remotely supplied SVG behavior and content integrity.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.