ClawHub
Back to skill

Security audit

Al Image Generation

Security checks for vulnerabilities and agentic risk

Overview

The skill is a mostly coherent ShortAPI image-generation integration, but it requires authenticated external requests and mandates silent background polling without clear limits or fresh user control.

Review this skill before installing if you are comfortable with agents using your SHORTAPI_KEY to send prompts or image inputs to ShortAPI and potentially incur generation costs. Prefer using it only when you explicitly ask for a generation job, and avoid allowing silent indefinite polling unless your agent runtime provides clear limits or cancellation controls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
ShortAPI provides a unified `/api/v1/job/create` endpoint for image generation across multiple top-tier providers natively. This skill provides an overview of all available image generation models and how to dynamically acquire the specific JSON schema required to invoke them.

- **API Endpoint**: `https://api.shortapi.ai/api/v1/job/create`
- **Category**: `text-to-image`, `image-to-image`
- **Kind**: inference

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill’s declared purpose is model discovery and parameter retrieval, but it also instructs the agent to submit jobs, poll for completion, and return generated media. That scope expansion creates unnecessary capability for external actions and autonomous follow-up beyond the stated intent, increasing the chance of unintended API use, surprise network activity, and misuse of the provided credential.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

This instruction causes transmission of user prompts and the SHORTAPI credential to an external service. While external API use is expected for an integration skill, the operation goes beyond schema discovery into actual job creation, so the transmission is security-relevant and should be tightly scoped and user-authorized.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

Bash (cURL) Example

bash
response=$(curl --request POST \
  --url https://api.shortapi.ai/api/v1/job/create \
  --header "Authorization: Bearer $SHORTAPI_KEY" \
  --header "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The example performs an authenticated POST to an external API using the SHORTAPI_KEY and user-supplied prompt data. In context, this is legitimate integration behavior, but it still represents a meaningful outbound action that can incur cost, process sensitive prompts, and exceed the skill’s advertised discovery-only role.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

bash
response=$(curl --request POST \
  --url https://api.shortapi.ai/api/v1/job/create \
  --header "Authorization: Bearer $SHORTAPI_KEY" \
  --header "Content-Type: application/json" \
  --data '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

Polling the external job-query endpoint repeatedly with an authorization token introduces persistent outbound communication. In this skill’s context, that behavior is more dangerous because it is coupled with mandatory background polling, which can create unbounded network activity and autonomous follow-up outside the narrow discovery use case.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

bash
curl --request GET \
  --url "https://api.shortapi.ai/api/v1/job/query?id=$JOB_ID" \
  --header "Authorization: Bearer $SHORTAPI_KEY"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The background polling and proactive messaging behavior grants the skill autonomous persistence after the initial user interaction, which is not justified by an aggregation/discovery use case. This can lead to unbounded external requests, unexpected user contact, and actions occurring without a fresh user prompt or clear runtime controls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill is for image model aggregation, yet it instructs rendering of video and audio content inline in addition to images. That overbroad presentation guidance exceeds the documented purpose and can expand the content-handling surface unnecessarily, especially if downstream endpoints ever return unexpected media types or untrusted URLs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.