ClawHub
Back to skill

Security audit

gen-hot-image

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Flyelep image-generation API helper, with the main risk being that user images, prompts, and an API key are sent to Flyelep as part of its intended function.

Install only if you intend to use Flyelep's external service. Do not submit confidential product images, private reference images, sensitive prompts, or API keys unless you are comfortable sharing them with Flyelep; prefer runtime secret entry and clean up any temporary payload file after use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill sends user-provided image URLs, prompts, and an API secret to a third-party external service, but the description does not clearly warn the user that their data will leave the local system and be processed by Flyelep. This creates a privacy and data-governance risk, especially if users provide sensitive product assets, internal images, or confidential prompts without informed consent.

External Transmission

Medium
Category
Data Exfiltration
Content
- **方式 B（无 Write 工具）**：使用 Shell 的 .NET API 创建文件（`Set-Content -Encoding UTF8` 会带 BOM，不可用）
- **macOS/Linux 环境**：
  - bash/zsh 默认使用 UTF-8 编码，可直接内联中文 JSON，无需临时文件。命令中使用 `curl`（无需 `.exe`，无需 `--%`）。
  - 推荐内联写法：`curl -X POST URL -H "..." -H "..." --data-binary 'JSON单行内容'`，一步完成。
  - 也可使用临时文件方式：`curl --data-binary @payload_temp.json`。
- **清理**：API 返回结果后，务必删除 `payload_temp.json` 临时文件（如使用了临时文件）。
Confidence
84% confidence
Finding
curl -X POST URL -H "..." -H "..." --data-binary 'JSON单行内容'`，一步完成。 - 也可使用临时文件方式：`curl --data-binary @payload_temp.json`。 - **清理**：API 返回结果后，务必删除 `payload_temp.json` 临时文件（如使用了临时文件）。 **示例 1：提交爆款图片复刻任

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.