ClawHub
Back to skill

Security audit

Pixelvault Upload

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward public image-upload helper, with the main risk being accidental sharing of sensitive screenshots or diagrams.

Install only if you want Codex to upload selected image files to PixelVault for public sharing. Review screenshots, diagrams, and build artifacts for secrets, personal data, or proprietary content before upload, because the resulting CDN links are described as permanent and globally cached.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill’s trigger description is broad enough to activate on many common requests involving screenshots, diagrams, or attachments, which increases the chance the agent invokes it without the user fully understanding that a public upload will occur. In this context, unintended invocation is especially risky because the action exfiltrates local files to an external service and returns permanent public URLs.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill repeatedly describes uploading images and returning permanent CDN URLs, but it does not require an explicit warning or confirmation that the destination is public and globally accessible. This can lead to accidental disclosure of sensitive screenshots, diagrams, or build artifacts, especially when combined with the broad invocation criteria.

Static analysis

No suspicious patterns detected.