ClawHub
Back to skill

Security audit

Pixelvault Setup

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a normal PixelVault setup helper with some credential-handling caution needed, not malware or deceptive behavior.

Before installing, confirm you actually want PixelVault setup. Treat any PixelVault API key as a secret: avoid saving it in shell history or committed files, prefer a secure credential store or narrowly scoped environment variable, and rotate the key if it may have been exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
85% confidence
Finding
The description includes broad phrases like "set up image hosting," which can cause the skill to trigger for requests that are not specifically about PixelVault. That can steer users into installing or authenticating a third-party CLI they did not explicitly ask for, increasing the chance of unnecessary credential entry or unintended system changes.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill recommends exporting a live API key into the shell environment without warning that shell profiles and process environments can persist secrets, leak through logs, or be exposed to other local processes and tooling. In a setup skill, this is especially risky because users may copy the pattern directly into persistent dotfiles or shared CI environments without understanding the exposure tradeoffs.

Static analysis

No suspicious patterns detected.