ClawHub
Back to skill

Security audit

EmpirioLabs AI Image

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed EmpirioLabs image-generation helper that uses an API key, sends chosen prompts/images to the service, and saves returned media locally.

Install only if you trust EmpirioLabs with the prompts and image files you choose to provide. Set EMPIRIOLABS_API_KEY in the environment, avoid passing sensitive local files as --image, and confirm cost-sensitive requests before generating many images or using premium models.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (10)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md
help="Any other model parameter, for example --param seed=42. Repeatable.")
    parser.add_argument("--out", help="Output file or directory. Default: the current directory.")
    parser.add_argument("--overwrite", action="store_true",
                        help="Replace existing files instead of adding a numeric suffix.")
    parser.add_argument("--no-download", action="store_true", help="Print the hosted URLs without saving files.")
    parser.add_argument("--timeout", type=float, default=600.0,
                        help="Seconds to wait for a queued image job (default 600).")

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/image.py (reported line 50)May include surrounding context.

python
help="Any other model parameter, for example --param seed=42. Repeatable.")
    parser.add_argument("--out", help="Output file or directory. Default: the current directory.")
    parser.add_argument("--overwrite", action="store_true",
                        help="Replace existing files instead of adding a numeric suffix.")
    parser.add_argument("--no-download", action="store_true", help="Print the hosted URLs without saving files.")
    parser.add_argument("--timeout", type=float, default=600.0,
                        help="Seconds to wait for a queued image job (default 600).")

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill explicitly requires environment access for an API key and network access to a remote service, but it does not declare any tool scope such as permissions or allowed-tools. That creates a trust and containment gap: an agent may invoke a network-capable script with secret-bearing environment access without an explicit policy boundary, increasing the chance of unintended outbound requests or misuse of the API key.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/empiriolabs_api.py (reported line 29)May include surrounding context.

python
__version__ = "1.0.0"

API_BASE = "https://api.empiriolabs.ai/v1"
KEY_ENV = "EMPIRIOLABS_API_KEY"
KEYS_URL = "https://platform.empiriolabs.ai/dashboard/api-keys"
BILLING_URL = "https://platform.empiriolabs.ai/dashboard/billing"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest describes a skill for generating and editing images, but this bundled client is built to recognize and save not just images, but also video and audio formats. That broader media-processing capability is not justified by the stated purpose of this specific skill and expands what the skill code can handle semantically beyond image workflows.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/empiriolabs_api.py (reported line 352)May include surrounding context.

python
def list_models(timeout=60.0):
    """The public model catalog. No API key is needed."""
    payload = get_json("/models", auth=False, timeout=timeout)
    models = payload.get("data") if isinstance(payload, dict) else payload
    return models if isinstance(models, list) else []

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/empiriolabs_api.py (reported line 360)May include surrounding context.

python
def list_models(timeout=60.0):
    """The public model catalog. No API key is needed."""
    payload = get_json("/models", auth=False, timeout=timeout)
    models = payload.get("data") if isinstance(payload, dict) else payload
    return models if isinstance(models, list) else []

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The media parsing code explicitly looks for "videos" and "audio" collections and URL fields like "video_url" and "audio_url", then treats them as valid outputs to save. For an image-only skill, this is an unjustified capability because it enables handling of non-image media types that the manifest does not mention.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The extension inference, download, and save routines are generic across image, audio, and video content, including support for mp4, webm, mov, mp3, wav, ogg, and related formats. In the context of a skill advertised only for image generation and editing, this broader output-saving capability is not clearly justified.

Content

No source excerpt is available for this finding.

Tainted flow: 'partial' from os.environ.get (line 689, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/empiriolabs_api.py (reported line 691)May include surrounding context.

python
os.makedirs(folder, exist_ok=True)
                partial = path + ".part"
                try:
                    with open(partial, "wb") as handle:
                        while True:
                            chunk = resp.read(1024 * 256)
                            if not chunk:

Static analysis

No suspicious patterns detected.