ClawHub
Back to skill

Security audit

Pollinations

Security checks across malware telemetry and agentic risk

Overview

This skill mostly matches its AI media purpose, but it appears to upload local images to an additional third-party file host without clear upfront consent.

Review this skill before installing if you might use private images, audio, video, prompts, or system instructions. Treat local image editing as potentially uploading your file not only to Pollinations but also to Catbox temporary hosting, and avoid sensitive or regulated content unless the publisher adds explicit consent, endpoint disclosure, and safer upload handling.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The finding indicates behavior not disclosed in the skill description: local source images may be uploaded to a separate third-party hosting service, litterbox.catbox.moe, during image editing. This creates a real data exfiltration and privacy risk because users may provide sensitive local files believing they are only sent to Pollinations, while the files are actually transmitted to an additional external service with different retention, access, and trust properties.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
When a local file is provided, the script silently uploads it to litterbox.catbox.moe, a third-party temporary hosting service unrelated to the advertised Pollinations API. This creates undisclosed data exfiltration risk for potentially sensitive local images and makes the trust boundary much broader than users would expect from the skill description.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The script exfiltrates local image content to a public temporary host in order to transform a local path into a URL, even though that host is outside the stated service scope. If the image contains personal, proprietary, or regulated information, this behavior can leak sensitive data and expose it to retention, indexing, or unauthorized access on external infrastructure.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The activation condition is overly broad: 'Use when user requests AI-powered content ... or mentions Pollinations' could cause the skill to trigger for a very wide range of requests, increasing chances of unintended external API calls and unnecessary data sharing. In a skill that can transmit prompts and local media to remote services, overbroad activation meaningfully enlarges the exposure surface.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The markdown does not clearly warn that prompts, local files, images, audio, and videos may be transmitted to external Pollinations API services. This is dangerous because users may unknowingly submit sensitive or proprietary content to third-party systems, leading to privacy, confidentiality, or compliance issues.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
When a local file path is provided, the script base64-encodes the image and embeds it directly into the API request, causing the full local image contents to be transmitted to a third-party remote service. In a skill context, users may reasonably expect analysis of a local file but may not realize this implies uploading sensitive image data off-host, creating a privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script sends the user prompt and optional system prompt to an external service over the network without any explicit user-facing disclosure at runtime. In an agent-skill context, prompts may contain sensitive user data, secrets, or internal instructions, so silent exfiltration to a third-party API creates a real privacy and data-handling risk even if the transmission is functionally intended.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script only mentions third-party temporary hosting in a usage note and proceeds to upload local files without a strong upfront privacy warning or explicit consent step. Users may reasonably assume a local image stays local or is sent only to Pollinations, so this behavior can cause unintended disclosure of sensitive content.

External Transmission

Medium
Category
Data Exfiltration
Content
AUTH_HEADER="-H \"Authorization: Bearer $POLLINATIONS_API_KEY\""
fi

RESPONSE=$(curl -s -H "Content-Type: application/json" \
  ${POLLINATIONS_API_KEY:+-H "Authorization: Bearer $POLLINATIONS_API_KEY"} \
  -X POST "https://gen.pollinations.ai/v1/chat/completions" \
  -d "$BODY")
Confidence
87% confidence
Finding
curl -s -H "Content-Type: application/json" \ ${POLLINATIONS_API_KEY:+-H "Authorization: Bearer $POLLINATIONS_API_KEY"} \ -X POST "https://gen.pollinations.ai/v1/chat/completions" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
# Make request
URL="https://gen.pollinations.ai/v1/chat/completions"

RESPONSE=$(curl -s -H "Content-Type: application/json" \
  ${POLLINATIONS_API_KEY:+-H "Authorization: Bearer $POLLINATIONS_API_KEY"} \
  -X POST "$URL" -d "$BODY")
Confidence
91% confidence
Finding
curl -s -H "Content-Type: application/json" \ ${POLLINATIONS_API_KEY:+-H "Authorization: Bearer $POLLINATIONS_API_KEY"} \ -X POST "$URL" -d

VirusTotal

No VirusTotal findings

View on VirusTotal