ClawHub
Back to skill

Security audit

Fannabe Generate

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Fannabe CLI wrapper for user-directed media generation, with expected account and credit implications.

Install only if you are comfortable letting an agent use your signed-in Fannabe CLI session for explicit Fannabe tasks. Generation can spend credits, and gallery or download commands may expose private account media, so review requests before running billable or account-reading actions.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Session Persistence

Medium
Category
Rogue Agent
Content
Use when: "generate an image", "make a video of my model",
  "animate this photo", "image-to-video", "motion control / transfer this
  dance onto my model", "character swap", "edit/restyle this image",
  "caption this video", "improve/rewrite this prompt", "describe this photo
  as a prompt", "show my gallery", "download my latest render", or
  "how many credits do I have". Wraps the `fannabe` CLI, which runs the same
  AI engines, settings, and credit pricing as the Fannabe web studio.
Confidence
94% confidence
Finding
The skill explicitly states that the CLI spends the signed-in user's credits and that authentication tokens are cached in ~/.fannabe, indicating persistent session state that can be reused across invocations. In this context, the agent can access account data, gallery contents, and trigger billable generations without a fresh authentication step, creating risk of unintended account actions and privacy exposure if the skill is invoked broadly.

Static analysis

No suspicious patterns detected.