ClawHub
Back to skill

Security audit

image-enlarge

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward image-enlargement API wrapper that clearly sends user-provided image URLs and a Flyelep API key to Flyelep for processing.

Install only if you trust Flyelep with the image URLs and API key you provide. Avoid sending private or sensitive images unless Flyelep's terms and data handling are acceptable to you, and provide the secretKey only at runtime rather than storing it in files or shared logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
- **方式 B（无 Write 工具）**：使用 Shell 的 .NET API 创建文件（`Set-Content -Encoding UTF8` 会带 BOM，不可用）
- **macOS/Linux 环境**：
  - bash/zsh 默认使用 UTF-8 编码，可直接内联中文 JSON，无需临时文件。命令中使用 `curl`（无需 `.exe`，无需 `--%`）。
  - 推荐内联写法：`curl -X POST URL -H "..." -H "..." --data-binary 'JSON单行内容'`，一步完成
  - 也可使用临时文件方式：`curl --data-binary @payload_temp.json`
- **清理**：API 返回结果后，务必删除 `payload_temp.json` 临时文件（如使用了临时文件）。
Confidence
90% confidence
Finding
curl -X POST URL -H "..." -H "..." --data-binary 'JSON单行内容'`，一步完成 - 也可使用临时文件方式：`curl --data-binary @payload_temp.json` - **清理**：API 返回结果后，务必删除 `payload_temp.json` 临时文件（如使用了临时文件）。 **示例 1：单张图片标准增强**

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.