ClawHub
Back to skill

Security audit

AI Full media generation automation flow Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward VAP media API helper that sends user prompts and media URLs to VAP to generate or edit media.

Install only if you are comfortable using VAP as an external media provider. Treat prompts and media URLs as data shared with VAP, keep VAP_API_KEY out of logs and chat output, and avoid using private, internal-network, or sensitive asset URLs for edit operations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (14)

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This skill explicitly instructs the agent to send user prompts and the bearer token to an external API endpoint. That is expected for an API integration, but it is still a real data egress/security boundary because user content and credentials leave the local agent environment and are transmitted to a third party service.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

Create Generation

bash
curl -s -X POST https://api.vapagent.com/api/v1/generations \
  -H "Authorization: Bearer $VAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"kind":"image","prompt":"PROMPT","params":{"aspect_ratio":"1:1"}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This skill explicitly instructs the agent to send user prompts and the bearer token to an external API endpoint. That is expected for an API integration, but it is still a real data egress/security boundary because user content and credentials leave the local agent environment and are transmitted to a third party service.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

Create Generation

bash
curl -s -X POST https://api.vapagent.com/api/v1/generations \
  -H "Authorization: Bearer $VAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"kind":"image","prompt":"PROMPT","params":{"aspect_ratio":"1:1"}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Polling the generation status sends the bearer token to the external API and retrieves result URLs from that provider. The request is routine for asynchronous APIs, but it still extends the trust boundary and may expose metadata about created content to the remote service.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Poll Generation

bash
curl -s https://api.vapagent.com/api/v1/generations/GENERATION_ID \
  -H "Authorization: Bearer $VAP_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The operation endpoint causes user-provided media URLs and edit instructions to be transmitted to an external service. In this context the transmission is intentional, but it creates a genuine privacy and trust risk because sensitive media references may be shared with the provider.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

Create Operation

bash
curl -s -X POST https://api.vapagent.com/api/v1/operations \
  -H "Authorization: Bearer $VAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"operation":"background_remove","media_url":"https://example.com/photo.png"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The operation endpoint causes user-provided media URLs and edit instructions to be transmitted to an external service. In this context the transmission is intentional, but it creates a genuine privacy and trust risk because sensitive media references may be shared with the provider.

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

Create Operation

bash
curl -s -X POST https://api.vapagent.com/api/v1/operations \
  -H "Authorization: Bearer $VAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"operation":"background_remove","media_url":"https://example.com/photo.png"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The polling request for operations is another intentional external transmission using the bearer token. While lower risk than submitting raw media, it still interacts with a third-party service and can reveal operation metadata and results.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

Poll Operation

bash
curl -s https://api.vapagent.com/api/v1/operations/OPERATION_ID \
  -H "Authorization: Bearer $VAP_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This example again demonstrates outbound transmission of prompts and credentials to the vendor API. Repeated examples do not increase severity, but they confirm the skill's core behavior is remote data submission and should be treated as an external exfiltration surface.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

Image

bash
curl -s -X POST https://api.vapagent.com/api/v1/generations \
  -H "Authorization: Bearer $VAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"kind":"image","prompt":"A fluffy orange tabby cat on a sunlit windowsill, soft bokeh, golden hour light, photorealistic","params":{"aspect_ratio":"16:9"}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This example again demonstrates outbound transmission of prompts and credentials to the vendor API. Repeated examples do not increase severity, but they confirm the skill's core behavior is remote data submission and should be treated as an external exfiltration surface.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

Image

bash
curl -s -X POST https://api.vapagent.com/api/v1/generations \
  -H "Authorization: Bearer $VAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"kind":"image","prompt":"A fluffy orange tabby cat on a sunlit windowsill, soft bokeh, golden hour light, photorealistic","params":{"aspect_ratio":"16:9"}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
79% confidence
Finding

This example polling call sends the API key to the provider and retrieves generation status from an external endpoint. It is expected behavior, but still a real network exposure point that should be disclosed and handled carefully.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

-H "Content-Type: application/json"
-d '{"kind":"image","prompt":"A fluffy orange tabby cat on a sunlit windowsill, soft bokeh, golden hour light, photorealistic","params":{"aspect_ratio":"16:9"}}'

curl -s https://api.vapagent.com/api/v1/generations/GENERATION_ID
-H "Authorization: Bearer $VAP_API_KEY"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The video generation example transmits potentially sensitive prompts and credentials to a third-party API. Video prompts can contain private or regulated content, so the skill's media-generation context makes external transmission more significant than a purely local transformation.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

Video

bash
curl -s -X POST https://api.vapagent.com/api/v1/generations \
  -H "Authorization: Bearer $VAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"kind":"video","prompt":"Drone shot over misty mountains at sunrise","params":{"duration":8,"aspect_ratio":"9:16","resolution":"1080p"}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The music generation example also sends user prompts and the bearer token to the external provider. This is intended functionality, but it remains a true data-transfer/security-boundary issue because user creative inputs leave the agent environment.

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

Music

bash
curl -s -X POST https://api.vapagent.com/api/v1/generations \
  -H "Authorization: Bearer $VAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"kind":"music","prompt":"Upbeat lo-fi hip hop beat, warm vinyl crackle, chill vibes","params":{"duration":120,"instrumental":true,"audio_format":"wav","loudness_preset":"streaming"}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The AI edit operation transmits a user-supplied media URL plus transformation instructions to an external API. In an agent setting this is more dangerous because user-provided URLs could point to private/internal resources, creating privacy leakage or indirect SSRF-style risk if the remote service fetches them.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

AI Edit

bash
curl -s -X POST https://api.vapagent.com/api/v1/operations \
  -H "Authorization: Bearer $VAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"operation":"ai_edit","media_url":"https://example.com/photo.jpg","prompt":"Change the background to a sunset beach"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The upscale operation shares external media references with the provider, which is an intentional but real exposure of user content location and associated credentials. If the URL references sensitive assets, the provider receives access context and content metadata.

Content

Scanner excerpt · SKILL.md (reported line 241)May include surrounding context.

Upscale

bash
curl -s -X POST https://api.vapagent.com/api/v1/operations \
  -H "Authorization: Bearer $VAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"operation":"upscale","media_url":"https://example.com/photo.jpg","options":{"scale":4}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

Background removal similarly sends user media references to an external service. The skill context makes this meaningfully risky because it is designed to process arbitrary user-provided URLs, which can expose sensitive images or private network resources to the provider.

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

Background Remove

bash
curl -s -X POST https://api.vapagent.com/api/v1/operations \
  -H "Authorization: Bearer $VAP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"operation":"background_remove","media_url":"https://example.com/photo.jpg"}'

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:268