ClawHub
Back to skill

Security audit

xAI Studio

Security checks across malware telemetry and agentic risk

Overview

This is a normal xAI media-generation skill, but users should understand that chosen prompts and media are sent to xAI and outputs are saved locally.

Install only if you are comfortable sending the prompts, images, videos, and URLs you choose to xAI for processing. Avoid confidential, regulated, client-owned, or personal media unless authorized, protect XAI_API_KEY, and review or clean the local output directory after sensitive work.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README explicitly instructs users to upload local images/videos or provide remote URLs to the xAI API and to save generated outputs locally, but it does not warn that source media may contain sensitive data or that outputs will be written to disk. In a skill designed for media generation/editing, this omission can lead users to unintentionally transmit private content to a third-party service and leave sensitive artifacts on the local filesystem.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documented workflows accept local images/videos and prompts, but the description does not warn that this content is sent to an external third-party API. Users may provide sensitive media or confidential prompts under the assumption processing is local, creating a real confidentiality and privacy risk.

Missing User Warnings

Low
Confidence
88% confidence
Finding
The skill writes generated and edited media to disk by default under a predictable output path, but this persistence behavior is not clearly presented as a warning. On shared systems or sensitive workflows, saved outputs can expose confidential or policy-sensitive content to other users, backups, or later unintended access.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
Local image and video files are automatically read, base64-encoded, and transmitted to the xAI API without an explicit warning, confirmation, or privacy notice. In a media-processing CLI, users may supply sensitive local files and reasonably not realize they are being uploaded off-host, which can cause unintended data disclosure to a third-party service.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.