ClawHub

DrawThings Image Generation

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says: generate images through a local DrawThings API and save the results locally, with no evidence of exfiltration or persistence beyond output files.

Install only if you intend to run it against your local DrawThings service. Treat prompts as potentially stored in the generated PNG metadata, and avoid using secrets, private client data, or regulated information in prompts you may later share.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill documentation indicates use of environment variables, network access to a local HTTP API, and file output, but the skill does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: users and orchestrators may approve or execute the skill without understanding that it can read configuration, contact services, and write files.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill states that PNG outputs embed prompts and generation parameters in metadata, but it does not warn users that sensitive text may persist in the files and be shared unintentionally. If prompts contain private, proprietary, or regulated information, that data can leak whenever the image is uploaded, emailed, or archived.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal