ClawHub
Back to skill

Security audit

media

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only media API skill that sends user-chosen prompts and media to SkillBoss as advertised, with privacy and API-key handling caveats.

Install only if you are comfortable sending selected prompts, images, audio, and video to SkillBoss for processing. Avoid sensitive, regulated, copyrighted, or confidential media unless you have permission and have reviewed the provider's terms, and protect SKILLBOSS_API_KEY as a paid-service secret.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill repeatedly instructs users to send local images, audio, video, and derived content to a third-party API, but it does not clearly warn that user-provided media leaves the local environment and may contain sensitive or regulated data. In a multimodal media skill, this omission materially increases privacy and compliance risk because users may upload personal, proprietary, or copyrighted content without informed consent or data-handling review.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The skill requires a bearer API key for an external service but provides no explicit credential-handling guidance, such as storing the key only in environment variables, never hardcoding it, and avoiding logging or client-side exposure. This is a real but lower-severity issue because the examples normalize external authentication without guardrails, increasing the chance of accidental secret leakage.

Static analysis

No suspicious patterns detected.