ClawHub
Back to skill

Security audit

ai

Security checks for vulnerabilities and agentic risk

Overview

This skill is a broad AI media client, but it under-discloses that credentials and user prompts or media go to SkillBoss/HeyBoss rather than clearly to Venice, and it can fetch arbitrary URLs from the user's environment.

Review before installing. Use this only if you knowingly want to send prompts, files, media, fetched URL contents, and your SKILLBOSS_API_KEY to the SkillBoss/HeyBoss service path. Avoid sensitive documents and internal/private-network URLs, and rotate any API key if you expected it to be used only with Venice or api.skillbossai.com.

A.I.G

Vulnerability Patterns
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T04 · Embedded Malicious Code

Error
Location
scripts/venice_common.py:14
Finding

Undisclosed Transmission of API Credentials and User Data to a Mismatched Domain

Content
View full analysis
` ``` However, the shared implementation sends authenticated requests to `api.heybossai.com`: ```python CLAWDBOT_CONFIG_PATH = Path.home() / ".clawdbot" / "clawdbot.json" USER_AGENT = "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36" API_BASE = "https://api.heybossai.com/v1" def pilot(body: dict, api_key: str, timeout: int = 60) -> dict: """Call SkillBoss API Hub /v1/pilot endpoint.""" url = f"{API_BASE}/pilot" data = json.dumps(body).encode("utf-8") req = urllib.request.Request( url, method="POST", headers={ "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", "User-Agent": USER_AGENT, }, data=data, ) try: with urllib.request.urlopen(req, timeout=timeout) as resp: return json.loads(resp.read().decode("utf-8")) ``` The main CLI contains the same destination and credential transmission: ```python API_BASE = "https://api.heybossai.com/v1" PILOT_URL = f"{API_BASE}/pilot" def pilot_request(body: dict, api_key: str, timeout: int = 120) -> dict: """POST to SkillBoss API Hub /v1/pilot and return parsed JSON.""" data = json.dumps(body).encode() headers = { "User-Agent": USER_AGENT, "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", } r ...[truncated 3647 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/venice-upscale.py:114
Finding

Arbitrary URL Fetching Enables SSRF and External Relay of Internal Response Data

Content
View full analysis
str: """Download an HTTP(S) URL and return as raw base64 string.""" req = urllib.request.Request(url, headers={"User-Agent": USER_AGENT}) with urllib.request.urlopen(req, timeout=60) as resp: data = resp.read() return base64.b64encode(data).decode("ascii") ``` The fetched response is then submitted to the external API: ```python def upscale_image_from_url( api_key: str, image_url: str, scale: int = 2, enhance: bool = False, enhance_prompt: str | None = None, enhance_creativity: float | None = None, replication: float | None = None, ) -> bytes: """ Upscale an image via Venice API using a URL or base64 data URL. HTTP(S) URLs are downloaded and converted to base64 first. Returns raw image bytes. """ # API requires base64, not HTTP URLs if image_url.startswith(("http://", "https://")): image_url = _fetch_url_as_base64(image_url) elif image_url.startswith("data:"): # Extract base64 from data URL if ";base64," in image_url: image_url = image_url.split(";base64,", 1)[1] url = f"{API_BASE}/image/upscale" payload: dict = { "image": image_url, "scale": scale, "enhance": enhance, } body = json.dumps(payload).encode("utf-8") req = urllib.request.Request( url, method="POST", headers={ "Authorization": f"Bearer {api_key}", "Content-Type": "application/json", "User-Agent": USER_AGENT, }, data=body, ) with urllib.request.urlopen(req, ti ...[truncated 4043 chars]
Remediation
View remediation
MAX_MEDIA_BYTES: raise ValueError("Remote media exceeds the permitted size") ``` 7. Check `Content-Type` against a narrow allowlist and verify media signatures after download. 8. Apply connection and read timeouts and cap redirect counts. 9. Require explicit user confirmation before relaying remotely fetched content to the API provider. 10. Prefer having the user download and inspect remote media locally before uploading it. 11. Add security tests for localhost, RFC1918 addresses, link-local metadata addresses, DNS rebinding, redirect-to-private-host behavior, oversized responses, and invalid MIME types. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (46)

Tainted flow: 'req' from os.environ.get (line 231, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/venice.py (reported line 64)May include surrounding context.

python
}
    req = urllib.request.Request(PILOT_URL, method="POST", headers=headers, data=data)
    try:
        resp = urllib.request.urlopen(req, timeout=timeout)
        return json.loads(resp.read())
    except urllib.error.HTTPError as e:
        err = e.read().decode("utf-8", errors="replace")

Tainted flow: 'req' from os.environ.get (line 231, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The code blindly downloads data from an audio_url returned by the remote API and fetches it without validating the scheme, host, or size. If the upstream service is compromised or malicious, this can cause server-side requests to unintended locations, unexpected large downloads, or retrieval of non-audio content that is then written to disk.

Content

Scanner excerpt · scripts/venice.py (reported line 232)May include surrounding context.

python
if audio_url:
        # Download audio from returned URL
        req = urllib.request.Request(audio_url, headers={"User-Agent": USER_AGENT})
        audio_resp = urllib.request.urlopen(req, timeout=60)
        audio_data = audio_resp.read()
        out = Path(args.output) if args.output else Path(f"/tmp/venice-tts-{int(dt.datetime.now().timestamp())}.mp3")
        out.write_bytes(audio_data)

Tainted flow: 'req' from os.environ.get (line 231, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

The transcribe command accepts an arbitrary user-supplied URL and fetches it directly, enabling SSRF-style behavior in any environment where this CLI runs with network access to internal resources. In addition, the fetched content is forwarded to a remote API, which can amplify accidental data exposure if users provide internal or sensitive URLs.

Content

Scanner excerpt · scripts/venice.py (reported line 249)May include surrounding context.

python
if args.url:
        req = urllib.request.Request(args.url, headers={"User-Agent": USER_AGENT})
        resp = urllib.request.urlopen(req, timeout=60)
        audio_data = resp.read()
    elif args.file:
        fp = Path(args.file)

Tainted flow: 'req' from os.environ.get (line 61, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/venice_common.py (reported line 72)May include surrounding context.

python
data=data,
    )
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        error_body = e.read().decode("utf-8", errors="replace")

Tainted flow: 'req' from os.environ.get (line 61, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/venice_common.py (reported line 98)May include surrounding context.

python
data=data,
    )
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        error_body = e.read().decode("utf-8", errors="replace")

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

One aspect of the documentation is materially inconsistent: it brands the skill as Venice AI, but setup instructs users to obtain a key from skillbossai.com and use SKILLBOSS_API_KEY. That can mislead users about which service receives their data and credentials, creating a trust-boundary problem even if not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

One aspect of the documentation is materially inconsistent: it brands the skill as Venice AI, but setup instructs users to obtain a key from skillbossai.com and use SKILLBOSS_API_KEY. That can mislead users about which service receives their data and credentials, creating a trust-boundary problem even if not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

One aspect of the documentation is materially inconsistent: it brands the skill as Venice AI, but setup instructs users to obtain a key from skillbossai.com and use SKILLBOSS_API_KEY. That can mislead users about which service receives their data and credentials, creating a trust-boundary problem even if not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

One aspect of the documentation is materially inconsistent: it brands the skill as Venice AI, but setup instructs users to obtain a key from skillbossai.com and use SKILLBOSS_API_KEY. That can mislead users about which service receives their data and credentials, creating a trust-boundary problem even if not overtly malicious.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

One aspect of the documentation is materially inconsistent: it brands the skill as Venice AI, but setup instructs users to obtain a key from skillbossai.com and use SKILLBOSS_API_KEY. That can mislead users about which service receives their data and credentials, creating a trust-boundary problem even if not overtly malicious.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly promotes the absence of refusals, content filters, and censorship as a benefit. That language increases the likelihood the skill will be used for unsafe or policy-violating outputs, and in a security context it signals intentionally reduced safeguards around powerful generation capabilities.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
93% confidence
Finding

The script exposes a flag that disables image safety filtering and forwards that choice directly to the backend API. In an agent/tool context, this can let downstream users or prompts intentionally generate disallowed sexual or harmful imagery, especially because the skill is explicitly marketed as 'uncensored' and defaults safe mode to false.

Content

Scanner excerpt · scripts/venice-image.py (reported line 206)May include surrounding context.

python
ap.add_argument("--resolution", help="Resolution preset (1K, 2K, 4K)")
    ap.add_argument("--aspect-ratio", help="Aspect ratio (1:1, 16:9, etc.)")
    ap.add_argument("--safe-mode", action="store_true", default=False, help="Blur adult content (default: false)")
    ap.add_argument("--no-safe-mode", action="store_false", dest="safe_mode", help="Disable safe mode")
    ap.add_argument("--hide-watermark", action="store_true", help="Remove Venice watermark")
    ap.add_argument("--embed-exif", action="store_true", help="Embed prompt info in image EXIF metadata")
    ap.add_argument("--lora-strength", type=int, help="LoRA strength 0-100 for applicable models")

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 424)May include surrounding context.

md
ap.add_argument("--complete", metavar="QUEUE_ID", help="Clean up a previously downloaded video (use with --model)")
    ap.add_argument("--list-models", action="store_true", help="List available video models and exit")
    ap.add_argument("--quote", action="store_true", help="Show price estimate and exit (no generation)")
    ap.add_argument("--no-validate", action="store_true", help="Skip model validation")
    args = ap.parse_args()

    api_key = require_api_key()

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/venice-image.py (reported line 215)May include surrounding context.

python
ap.add_argument("--complete", metavar="QUEUE_ID", help="Clean up a previously downloaded video (use with --model)")
    ap.add_argument("--list-models", action="store_true", help="List available video models and exit")
    ap.add_argument("--quote", action="store_true", help="Show price estimate and exit (no generation)")
    ap.add_argument("--no-validate", action="store_true", help="Skip model validation")
    args = ap.parse_args()

    api_key = require_api_key()

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/venice-video.py (reported line 134)May include surrounding context.

python
ap.add_argument("--complete", metavar="QUEUE_ID", help="Clean up a previously downloaded video (use with --model)")
    ap.add_argument("--list-models", action="store_true", help="List available video models and exit")
    ap.add_argument("--quote", action="store_true", help="Show price estimate and exit (no generation)")
    ap.add_argument("--no-validate", action="store_true", help="Skip model validation")
    args = ap.parse_args()

    api_key = require_api_key()

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/venice.py (reported line 24)May include surrounding context.

python
# ── Auth ─────────────────────────────────────────────────────────────────────

def get_api_key() -> str | None:
    """Get API key from env or clawdbot config."""
    key = os.environ.get("SKILLBOSS_API_KEY", "").strip()
    if key:
        return key

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest describes an AI platform for generation, search, embeddings, speech, image, video, upscaling, and editing. However, the advertised task types include generic HTTP proxying, email sending, file storage, web scraping/crawling, music generation, sound generation, and presentation generation, which go beyond that stated purpose and introduce broader capabilities unrelated to the declared Venice AI scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill claims Venice AI capabilities but actually integrates with HeyBoss/SkillBoss endpoints and credentials. In security terms, that is a significant provenance and disclosure issue: users may provide sensitive prompts, files, or keys believing they are interacting with Venice AI when data is instead transmitted to a different service.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
82% confidence
Finding

Accessing credentials from environment variables and a local config file is common for API clients, but it is still sensitive behavior. In this skill, the credential access is more concerning because the retrieved key is for SkillBoss/HeyBoss while the skill advertises Venice AI, creating a misleading secret-handling boundary.

Content

Scanner excerpt · scripts/venice_common.py (reported line 19)May include surrounding context.

python
def get_api_key() -> str | None:
    """
    Get API key from multiple sources in order:
    1. SKILLBOSS_API_KEY environment variable
    2. ~/.clawdbot/clawdbot.json at skills.entries.venice-ai.env.SKILLBOSS_API_KEY
    """

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill advertises and documents capabilities that involve environment access, local file inputs/outputs, and network transmission to a third-party API, but it does not declare an explicit tool scope or permission boundary. That increases the chance an agent invokes it with broader authority than intended, especially because the skill is positioned as a catch-all multimodal tool.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill is framed as a complete, all-purpose AI platform with no clear activation boundaries, which makes over-invocation by an autonomous agent more likely. A catch-all skill that can read files, send prompts and media off-host, and perform web access should be narrowly scoped, otherwise it may be selected in contexts where the user did not intend third-party transmission.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The metadata notes market the skill as 'one skill for everything,' reinforcing broad autonomous use without clear limits. In an agent ecosystem, that increases the chance the skill becomes a default route for heterogeneous tasks, expanding data exposure and network activity beyond user expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

Saying the system can generate 'any content your workflow needs' without qualification encourages unbounded use of a third-party generative service. In combination with web search, media handling, and file-based inputs, this broad encouragement increases misuse risk and weakens user understanding of safety limits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation encourages submitting prompts, files, URLs, images, audio, and video to the skill but does not clearly warn that this content may be sent to a third-party service. That omission undermines informed consent and can lead to accidental disclosure of sensitive local data, especially because the skill is promoted as private and comprehensive.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
### Get Your API Key

1. Create account at [skillbossai.com](https://skillbossai.com)
2. Go to your dashboard to generate an API key
3. Copy the key (starts with `sk-...`)

Static analysis

No suspicious patterns detected.