ClawHub
Back to skill

Security audit

Reverse Image Search

Security checks across malware telemetry and agentic risk

Overview

This skill performs the reverse image search it advertises, but users should treat submitted images as shared with external search providers.

Install only if you are comfortable with submitted images or image URLs being processed by Yandex, Google, or Bing. Avoid using private photos, internal documents, IDs, screenshots, or confidential images unless you are willing to share them with the selected provider.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill advertises support for URLs and local files but does not warn that submitted images, URLs, or derived image data may be transmitted to third-party services such as Yandex, Google, and Bing. This can expose private, sensitive, or internal images to external providers without informed user consent, which is especially risky for local files and non-public content.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
When the input is a local file, the script passes that file to third-party reverse-image-search providers, which may upload the image contents to external services. In this skill context, that can expose sensitive local images, screenshots, IDs, or internal documents without explicit consent or a privacy warning, making the issue more dangerous because reverse image search inherently sends user content to outside platforms.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.