ClawHub
Back to skill

Security audit

Vultr Inference

Security checks for vulnerabilities and agentic risk

Overview

This looks like a legitimate Vultr inference helper, but it needs Review because it uses a broad Vultr API key and downloads remote output without enough safeguards.

Install only if you are comfortable sending prompts and chat messages to Vultr and using a Vultr API key from your local config. Prefer an inference-only, least-privileged key if available, keep the key file private, avoid sensitive prompts, and review the script before using generated image downloads or custom output paths.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/vultr-inference.py:29
Finding

Bearer credential may be disclosed through unrestricted HTTP redirects

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/vultr-inference.py:45
Finding

Untrusted API-provided URLs are downloaded without destination or size validation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The description overstates the skill's capabilities. While the code does support Vultr Inference image generation and uses Flux-style image models, it does not contain any logic for text generation, chat/completions, or invoking LLM endpoints. The additional model-listing command is related to the API and not inherently suspicious, but the main mismatch is that the declared purpose says the skill can generate both images and text, whereas the supplied code only handles image generation and listing models.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill performs network operations against an external API but does not declare any explicit tool scope or permissions. This weakens reviewability and enforcement, making it easier for a skill to transmit user data or use credentials without clear platform-level consent boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill documents sending prompts and chat messages to a third-party inference provider but does not clearly warn users that their inputs leave the local environment. This can lead to unintended disclosure of sensitive prompts, proprietary data, or personal information to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

Generate Image

bash
curl -X POST "https://api.vultrinference.com/v1/images/generations" \
  -H "Authorization: Bearer $VULTR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

Chat Completion

bash
curl -X POST "https://api.vultrinference.com/v1/chat/completions" \
  -H "Authorization: Bearer $VULTR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md
API_KEY = open(os.path.expanduser("~/.config/vultr/api_key")).read().strip()

# Generate image
response = requests.post(
    "https://api.vultrinference.com/v1/images/generations",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md
API_KEY = open(os.path.expanduser("~/.config/vultr/api_key")).read().strip()

# Generate image
response = requests.post(
    "https://api.vultrinference.com/v1/images/generations",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest describes a skill that can generate both images and text using Vultr Inference API, but this file only defines image generation and a model-listing command. There is no code path for text completions or LLM prompt handling, so the implemented behavior is materially narrower than the claimed scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
import sys
import urllib.request

API_BASE = "https://api.vultrinference.com/v1"

def get_api_key():
    key_path = os.path.expanduser("~/.config/vultr/api_key")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
import sys
import urllib.request

API_BASE = "https://api.vultrinference.com/v1"

def get_api_key():
    key_path = os.path.expanduser("~/.config/vultr/api_key")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md
import sys
import urllib.request

API_BASE = "https://api.vultrinference.com/v1"

def get_api_key():
    key_path = os.path.expanduser("~/.config/vultr/api_key")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
import sys
import urllib.request

API_BASE = "https://api.vultrinference.com/v1"

def get_api_key():
    key_path = os.path.expanduser("~/.config/vultr/api_key")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/vultr-inference.py (reported line 10)May include surrounding context.

python
import sys
import urllib.request

API_BASE = "https://api.vultrinference.com/v1"

def get_api_key():
    key_path = os.path.expanduser("~/.config/vultr/api_key")

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The documentation instructs reading an API key from disk without an explicit warning about secure credential handling. Although this does not exfiltrate the key by itself, it normalizes sensitive secret use without advising on file permissions, redaction, or avoiding accidental exposure in logs and examples.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The inline module documentation explicitly frames this helper as only for image generation, while the skill-level description claims broader support for text generation as well. This creates an intent/documentation inconsistency about the scope of the skill's functionality.

Content

No source excerpt is available for this finding.