ClawHub
Back to skill

Security audit

Seede Design Agent Skills

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Seede AI design-service integration, with normal cloud-upload and API-token risks that users should manage carefully.

Before installing, verify the Seede CLI package/source, use a dedicated expiring API token, avoid exposing the token in prompts, logs, shell history, or shared environments, and upload only files or URLs you are authorized to send to Seede for cloud processing.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The README encourages uploading user assets and sending prompts to an external AI service but does not clearly disclose that user-provided files, brand materials, and prompt contents will leave the local environment and be transmitted to Seede AI. In an agent context, this omission is more dangerous because autonomous workflows may forward sensitive documents, logos, or internal marketing content without the operator realizing the data-sharing boundary.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README instructs users to create API tokens and set them in environment variables, but it does not warn that these credentials must be kept secret and never committed, logged, or exposed in shared shells/CI output. In an agent and CLI setting, token misuse can lead to unauthorized API access, billing abuse, and exposure of designs or managed assets tied to the account.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs agents to upload local files and then use publicly accessible asset URLs, but it does not warn that uploaded materials may become externally reachable or visible to the third-party service. In an agent context, this can lead to unintentional disclosure of logos, internal mockups, or other sensitive user-provided files if the agent uploads assets without explicit user consent and privacy notice.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The documentation explains how to create and use API tokens, including that the full token is shown once, but it does not clearly emphasize that the token is a sensitive credential that must not be logged, embedded in prompts, or exposed in shared terminals/output. In agent workflows, missing credential-handling guidance increases the chance of accidental secret leakage through logs, transcripts, screenshots, or generated shell history.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.