ClawHub
Back to skill

Security audit

visual-understanding

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward GLM vision API integration, with expected privacy and supply-chain risks that are disclosed enough for normal caution.

Install this only if you are comfortable sending selected images, public image URLs, and prompts to Zhipu's external API. Avoid sensitive images unless they are sanitized, keep `ZHIPUAI_API_KEY` in an environment variable, and prefer installing a pinned reviewed `zai` version in a virtual environment or container.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
skill.md:14
Finding

Unpinned Third-Party Python Dependency Installation

Content
View full analysis
Remediation
View remediation
" ``` 2. Use a lock file or requirements file containing cryptographic hashes: ```text zai== \ --hash=sha256: ``` Install it with hash enforcement: ```bash pip install --require-hashes -r requirements.txt ``` 3. Obtain the expected hash from a trusted release process and verify the package name, publisher, and official distribution source before documenting it. 4. Review and approve dependency updates rather than automatically accepting the newest release. Use automated vulnerability monitoring while requiring human review for lock-file changes. 5. Install the package in a dedicated virtual environment or minimally privileged container. Do not run `pip` as root, and avoid exposing unrelated credentials to installation steps. 6. Separate dependency installation from runtime execution where practical. Do not provide `ZHIPUAI_API_KEY` or other production secrets to the package installation process. 7. Update both the metadata `install_command` and the documented shell example so they use the same pinned, integrity-verified dependency specification. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill is explicitly designed to transmit user-supplied images and prompts to an external third-party API, including support for base64-encoding local images and fetching public image URLs. In this context, the transmission is intentional and central to the skill’s function, but it still creates real confidentiality and privacy risk if users send sensitive local images, PII, or internal content to the remote service.

Content

Scanner excerpt · skill.md (reported line 3)May include surrounding context.

md
---
name: glm-4.6v-vision-connector
description: "智谱 GLM-4.6V 多模态视觉模型集成插件。支持本地图像解析（Base64）及公网链接读取。优先提供 zai SDK 接入，并包含 cURL 原生降级方案。"
version: "1.1.0"
homepage: "https://github.com/zai-org/GLM-V"
repository: "https://github.com/zai-org/GLM-V.git"

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The document is primarily written in Chinese, but the cURL example hard-codes the user text prompt in English: "What are the pics talk about?". This introduces a language preference in the skill content without any opt-in or note that users may choose their preferred language, which can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.