ClawHub
Back to skill

Security audit

Showmeai

Security checks across malware telemetry and agentic risk

Overview

This media-generation skill is mostly coherent, but needs Review because its downloader can send the user's ShowMeAI API key to result URLs outside the ShowMeAI API.

Before installing, confirm you are comfortable storing a ShowMeAI API key locally and sending selected prompts/files to ShowMeAI. Ask the publisher to change result downloads so Authorization is only sent to trusted ShowMeAI API endpoints, and do not change the configured base URL unless you trust the endpoint receiving the key.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill directs the agent to execute a local Python script with network, file read/write, environment, and shell capabilities, but the skill metadata does not declare any permissions or capability requirements. This creates a transparency and policy-enforcement gap: a host may treat the skill as low-privilege while it can still access secrets, modify local files, and make outbound requests through the bundled runtime.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.