Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward remote image-cropping helper, but users should know images or image URLs are sent to an external service.
Install this only if you are comfortable sending image URLs or selected local image files to imageclaw's hosted API. Avoid using it for private, sensitive, internal-only, or credential-bearing image URLs unless you have confirmed the service's data handling terms.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
metadata:
version: "0.1.0"
homepage: "https://imageclaw.net"
docs: "https://api.imageclaw.net/docs"
api_base_url: "https://api.imageclaw.net"
maintainer: "imageclaw"
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
metadata:
version: "0.1.0"
homepage: "https://imageclaw.net"
docs: "https://api.imageclaw.net/docs"
api_base_url: "https://api.imageclaw.net"
maintainer: "imageclaw"
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
metadata:
version: "0.1.0"
homepage: "https://imageclaw.net"
docs: "https://api.imageclaw.net/docs"
api_base_url: "https://api.imageclaw.net"
maintainer: "imageclaw"
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
metadata:
version: "0.1.0"
homepage: "https://imageclaw.net"
docs: "https://api.imageclaw.net/docs"
api_base_url: "https://api.imageclaw.net"
maintainer: "imageclaw"
---
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
metadata:
version: "0.1.0"
homepage: "https://imageclaw.net"
docs: "https://api.imageclaw.net/docs"
api_base_url: "https://api.imageclaw.net"
maintainer: "imageclaw"
---
The sample curl command operationalizes external transmission by posting cropping parameters to a third-party API, so it is more than a passive URL mention. In context, this is moderately dangerous because the skill encourages network use without requiring disclosure, and URL-based image retrieval by the service can expose sensitive links or abuse internal-only resources if not constrained.
curl -sS -X POST "https://api.imageclaw.net/crop" \
-H "content-type: application/json" \
-d '{
"url": "https://picsum.photos/800/600",
The sample curl command operationalizes external transmission by posting cropping parameters to a third-party API, so it is more than a passive URL mention. In context, this is moderately dangerous because the skill encourages network use without requiring disclosure, and URL-based image retrieval by the service can expose sensitive links or abuse internal-only resources if not constrained.
curl -sS -X POST "https://api.imageclaw.net/crop" \
-H "content-type: application/json" \
-d '{
"url": "https://picsum.photos/800/600",
The skill explicitly instructs agents to upload a local file from an absolute path to a third-party remote API, but it does not require a user-facing notice or consent step before transmitting the file off-device. This is dangerous because local images may contain sensitive content or metadata, and the skill normalizes exfiltration of local data to an external service without adequate disclosure or trust controls.
This upload command sends a local file from an absolute filesystem path to an external API, creating a direct path for off-device transfer of potentially sensitive local content. In the context of an agent skill, this is more dangerous because agents may act on local files automatically, and the skill does not require consent, redaction, file-type restrictions, or any warning that private data will leave the environment.
curl -sS -X POST "https://api.imageclaw.net/crop/upload" \
-F "file=@/absolute/path/to/photo.jpg" \
-F "width=256" \
-F "height=256"