ClawHub
Back to skill

Security audit

async-free-creation

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Flyelep image-generation API helper that discloses its external calls and credential use.

Install this only if you are comfortable sending prompts and any reference image URLs to Flyelep. Provide the secretKey only at runtime, avoid sensitive or internal-only image URLs, and remove any temporary payload file after use if one is created.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill's activation text is broad enough to match common user phrases like '自由创作' or requests to generate multiple images from prompts and references, which can cause the skill to trigger in situations the user did not intend. Because this skill sends user-supplied prompts and image URLs to an external service, accidental activation can lead to unintended external data transmission and execution of side effects.

External Transmission

Medium
Category
Data Exfiltration
Content
- **方式 B（无 Write 工具）**：使用 Shell 的 .NET API 创建文件（`Set-Content -Encoding UTF8` 会带 BOM，不可用）
- **macOS/Linux 环境**：
  - bash/zsh 默认使用 UTF-8 编码，可直接内联中文 JSON，无需临时文件。命令中使用 `curl`（无需 `.exe`，无需 `--%`）。
  - 推荐内联写法：`curl -X POST URL -H "..." -H "..." --data-binary 'JSON单行内容'`，一步完成。
  - 也可使用临时文件方式：`curl --data-binary @payload_temp.json`。
- **清理**：API 返回结果后，务必删除 `payload_temp.json` 临时文件（如使用了临时文件）。
Confidence
90% confidence
Finding
curl -X POST URL -H "..." -H "..." --data-binary 'JSON单行内容'`，一步完成。 - 也可使用临时文件方式：`curl --data-binary @payload_temp.json`。 - **清理**：API 返回结果后，务必删除 `payload_temp.json` 临时文件（如使用了临时文件）。 **示例 1：创建异步自由创作任

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.