ClawHub
Back to skill

Security audit

Seedream 5 via BytePlus

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it sends image prompts to BytePlus Ark and saves the generated image locally.

Before installing, use a dedicated BytePlus Ark API key, avoid putting confidential material in prompts, and confirm output paths before writing files. The skill will call BytePlus Ark over the network and store the returned image locally.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill omits a clear warning that user prompts and API responses are sent to a third-party provider and that returned images are downloaded and stored locally. This can expose sensitive prompts, provider-returned data, and local filesystem side effects without informed user consent, which is especially risky if users include confidential content in prompts.

Static analysis

No suspicious patterns detected.