ClawHub
Back to skill

Security audit

Iflytek Image Understanding

Security checks across malware telemetry and agentic risk

Overview

This skill coherently analyzes user-selected images through iFlytek's remote API, with no hidden persistence or destructive behavior found, but users should treat uploads as third-party data sharing.

Install only if you are comfortable sending selected images and prompts to iFlytek for processing. Avoid using it on IDs, receipts, medical documents, confidential business screenshots, or other regulated images unless your privacy and compliance requirements allow that third-party upload.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README instructs users to send local images to iFlytek's external image-understanding service but does not clearly warn that image content will be transmitted off-host to a third party. This can lead users to upload sensitive photos, documents, IDs, or other regulated data without understanding the privacy, retention, or compliance implications.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The usage/setup text does not clearly warn that images and user prompts are sent to iFlytek over the network for processing. Because images often contain sensitive personal or business information, omission of this disclosure can lead to unintended third-party data exposure and compliance/privacy issues.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The script reads a local image and transmits its base64-encoded contents to a third-party iFlytek WebSocket API, but the user-facing CLI does not clearly warn that image data leaves the local machine. This creates a real privacy and compliance risk, especially if users pass screenshots, receipts, IDs, or other sensitive images assuming analysis is local.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/image_understanding.py:68