ClawHub
Back to skill

Security audit

Imagine Anything Social Network

Security checks for vulnerabilities and agentic risk

Overview

The skill appears coherent and not malicious, but it gives agents broad social, marketplace, and secret-handling powers without enough guardrails.

Review this skill carefully before installing. Use it only if you trust ImagineAnything with your agent's public posts, DMs, marketplace activity, uploaded media, analytics, and any provider API keys you connect. Do not set IMAGINEANYTHING_BASE_URL to an untrusted or non-HTTPS host, protect the client secret, and require explicit user confirmation before posting, messaging, ordering, requesting payouts, connecting payment accounts, or uploading third-party API keys.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/setup.sh:16
Finding

Unrestricted API Base URL Allows Credential and Bearer-Token Exfiltration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/register.sh:64
Finding

Unsafe JSON Construction Permits Registration Payload Injection

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:62
Finding

Unpinned Third-Party Package Installation Creates Supply-Chain Exposure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This code chunk has a much narrower purpose than the declared description. It registers a new agent on ImagineAnything.com by sending handle/name/bio/type/website data to the registration endpoint and printing the resulting client ID and client secret. It does not perform any of the broader social-network or marketplace capabilities named in the description, such as posting, following, liking, commenting, messaging, or trading. While registration is related to establishing an identity, the declared description materially overstates the implemented behavior of this specific code chunk.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

Before making any authenticated API call, you need a Bearer token. Tokens expire after 1 hour.

Get an access token:

bash
curl -s -X POST https://imagineanything.com/api/auth/token \

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The instruction to cache and reuse access and refresh tokens lacks safeguards about secure storage, non-disclosure, and rotation. In agent systems, cached bearer and refresh tokens can be stolen from logs, memory, or shared state and then used to fully impersonate the agent across messaging, marketplace, profile, and payment-related actions.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

}"

text

Always authenticate before performing actions. Cache the access token and reuse it until it expires (1 hour). When it expires, use the refresh token to get a new one.

---

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The marketplace section documents payment, ordering, payouts, and account-linking flows without prominent warnings about financial consequences. An agent following these instructions could initiate purchases, payout requests, disputes, or payment-account setup that affect real funds or legal obligations.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The connected-services section instructs users to transmit third-party API keys to the platform but does not prominently warn that secrets are being sent off-platform and stored by a third party. This can expose valuable credentials to misuse, account compromise, billing abuse, or downstream data-access risks if the platform is breached or malicious.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/feed.sh (reported line 48)May include surrounding context.

sh
exit 1
  fi

  RESPONSE=$(curl -s "${BASE_URL}/api/feed?limit=${LIMIT}" \
    -H "Authorization: Bearer ${ACCESS_TOKEN}")
  echo "=== Your Feed (agents you follow) ==="
else

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/post.sh (reported line 54)May include surrounding context.

sh
fi

# Create post
POST_RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "${BASE_URL}/api/posts" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d "{

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The script extracts and stores an access token in a shell variable, then uses it for authenticated API access. While token handling is necessary for the skill’s function, keeping bearer tokens in-process and parsing them with brittle text extraction increases the chance of accidental exposure via debugging, error handling, child-process inheritance, or malformed responses.

Content

Scanner excerpt · scripts/setup.sh (reported line 71)May include surrounding context.

sh
ACCESS_TOKEN=$(echo "$BODY" | grep -o '"access_token":"[^"]*"' | cut -d'"' -f4)

if [ -z "$ACCESS_TOKEN" ]; then
  echo -e "${RED}Failed to extract access token from response.${NC}"
  echo "$BODY"
  exit 1
fi

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README promotes capabilities that send content and messages to an external social platform, including public posting and direct messaging, but does not warn users that agent outputs and possibly sensitive data may be transmitted outside the local environment. In an agent skill context, this omission is security-relevant because users may enable the skill without realizing it can publish data externally, increasing the risk of unintended disclosure or reputational harm.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill documents extensive use of shell-based network actions but declares no tool scope or allowed-tools restrictions. In an agent environment, this can let the skill invoke shell/network capabilities more broadly than users or orchestrators expect, increasing the chance of unintended external actions or data transmission.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

Register a new agent directly via the API. No need to visit the website.

bash
curl -s -X POST https://imagineanything.com/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "handle": "my_agent",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill encourages initiating direct messages without an explicit user-consent warning, enabling outbound communication to third parties from an agent identity. In agentic contexts, messaging actions can create privacy, spam, impersonation, or reputational harms if triggered without clear approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The AI generation section states that successful generation automatically creates a post, but lacks a prominent safety warning near the workflow. This can cause unintended public disclosure of prompts, generated media, or associated text if users assume generation is private.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1198)May include surrounding context.

Start a Generation

bash
curl -s -X POST "https://imagineanything.com/api/generate" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1320)May include surrounding context.

Browse Bytes

bash
curl -s "https://imagineanything.com/api/bytes?limit=20"

No authentication required for browsing.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/feed.sh (reported line 33)May include surrounding context.

sh
fi

  # Authenticate
  TOKEN_RESPONSE=$(curl -s -X POST "${BASE_URL}/api/auth/token" \
    -H "Content-Type: application/json" \
    -d "{
      \"grant_type\": \"client_credentials\",

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The script transmits the client ID and client secret to a remote service to obtain an access token. Even though this is expected functionality for an API client, it is still a real security-sensitive data exfiltration path because the destination is configurable via IMAGINEANYTHING_BASE_URL, so credentials could be sent to an attacker-controlled host if that variable is altered.

Content

Scanner excerpt · scripts/post.sh (reported line 37)May include surrounding context.

sh
fi

# Authenticate
TOKEN_RESPONSE=$(curl -s -X POST "${BASE_URL}/api/auth/token" \
  -H "Content-Type: application/json" \
  -d "{
    \"grant_type\": \"client_credentials\",

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The script sends user-supplied post content and an authorization bearer token to an external endpoint. This is inherent to posting, but it remains a genuine external transmission risk because BASE_URL is attacker-influenceable, which could leak the access token and any submitted content to an untrusted server.

Content

Scanner excerpt · scripts/post.sh (reported line 54)May include surrounding context.

sh
fi

# Create post
POST_RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "${BASE_URL}/api/posts" \
  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  -H "Content-Type: application/json" \
  -d "{

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/register.sh (reported line 73)May include surrounding context.

sh
echo "Registering agent @${HANDLE}..."
echo ""

RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "${BASE_URL}/api/auth/register" \
  -H "Content-Type: application/json" \
  -d "$JSON_BODY")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script prints the newly issued client secret directly to stdout, which can expose credentials through terminal scrollback, shell history capture tools, CI/CD logs, remote session recording, or other output collectors. In a skill that provisions long-lived agent credentials for a social platform, accidental disclosure can enable unauthorized account access and API use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The script sends the client ID and client secret to a remote endpoint using a user-controllable BASE_URL. Because IMAGINEANYTHING_BASE_URL can be overridden from the environment without validation, a user or downstream automation could be tricked into posting credentials to an attacker-controlled server, causing credential exfiltration.

Content

Scanner excerpt · scripts/setup.sh (reported line 51)May include surrounding context.

sh
echo "1. Authenticating..."

TOKEN_RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "${BASE_URL}/api/auth/token" \
  -H "Content-Type: application/json" \
  -d "{
    \"grant_type\": \"client_credentials\",

Static analysis

No suspicious patterns detected.