ClawHub
Back to skill

Security audit

Remove Background

Security checks for vulnerabilities and agentic risk

Overview

This image background-removal skill appears functional, but it under-scopes a powerful Bria API helper and stores reusable Bria credentials in a plaintext local file.

Review before installing. Use only with images you are authorized to send to Bria, avoid sensitive or proprietary images unless third-party processing is acceptable, and protect or remove ~/.bria/credentials after use. Treat the included helper as broader than background removal unless it is constrained to the intended endpoint.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill embeds shell commands that read local credential files, perform network requests, and write tokens to disk, but it declares no permissions or capability boundaries. This is dangerous because users and orchestrators cannot accurately assess or constrain what the skill can do, increasing the chance of unintended command execution and unauthorized data handling.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill is presented as a narrowly scoped background-removal tool, but it sources a helper that can invoke arbitrary Bria API endpoints and support broader image operations. This mismatch is dangerous because it defeats user and policy expectations, enabling a supposedly limited skill to perform materially different remote actions with the same credentials.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The helper advertises and demonstrates image generation, background replacement, and generic image editing workflows, which materially exceed the skill's declared purpose of background removal. In an agent setting, this broadens the callable capability surface and can cause the skill to be used for unintended actions, bypassing routing or policy assumptions tied to the narrower skill description.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The function accepts an arbitrary endpoint argument and concatenates it directly onto the API base, allowing callers to invoke any Bria API operation the token permits rather than only background removal. In a skill ecosystem, this is a capability-expansion flaw: downstream agents or prompt-injected inputs could repurpose the skill for unrelated generation/editing actions under the guise of a constrained tool.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill sends local image files and user-provided image URLs to Bria's external service without an explicit privacy notice or consent step. This is dangerous because images may contain sensitive personal, commercial, or embedded metadata, and users may not realize their local content is leaving the environment.

Credential Access

High
Category
Privilege Escalation
Content
## Setup — Authentication

Before making any API call, you need a valid Bria access token.

### Step 1: Check for existing credentials
Confidence
84% confidence
Finding
The skill accesses bearer tokens, refresh tokens, and resolved API keys, then stores them in a plaintext credentials file under the user's home directory. Even though authentication is necessary, this is dangerous because any other local process or misconfigured permissions could read or reuse these credentials to access the external API.

Session Persistence

Medium
Category
Rogue Agent
Content
if [ -n "$ACCESS_TOKEN" ]; then
    BRIA_ACCESS_TOKEN="$ACCESS_TOKEN"
    REFRESH_TOKEN=$(printf '%s' "$TOKEN_RESPONSE" | sed -n 's/.*"refresh_token" *: *"\([^"]*\)".*/\1/p')
    mkdir -p ~/.bria
    printf 'access_token=%s\nrefresh_token=%s\n' "$BRIA_ACCESS_TOKEN" "$REFRESH_TOKEN" > "$HOME/.bria/credentials"
    echo "AUTHENTICATED"
    break
Confidence
94% confidence
Finding
The skill persists access and refresh tokens in ~/.bria/credentials for reuse across sessions. This is dangerous because long-lived local credential caching expands the window for credential theft and unauthorized reuse, especially on shared systems or where file permissions are weak.

Static analysis

No suspicious patterns detected.