ClawHub
Back to skill

Security audit

AI Image Generation

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documentation-style image generation helper that clearly discloses its provider API use and limited local preference memory.

Install only if you are comfortable sending prompts and any reference images to the selected image provider. Use environment variables for API keys, avoid sensitive or regulated images unless provider policy allows it, and run the optional pip installs in a dedicated virtual environment with pinned dependencies where possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
replicate.md:10
Finding

Unpinned Replicate Package Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: replicate.md:10
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash
pip install replicate

Technical Analysis

The documented command installs the latest available version of the replicate package and its transitive dependencies from the user's configured Python package index. It does not constrain the package version, verify integrity hashes, require a lock file, or isolate installation in a virtual environment.

Because the resolved package set can change after the Skill has been audited, executing this command places trust in mutable external artifacts. A compromised package release, package-index account, transitive dependency, or configured mirror could introduce attacker-controlled code. Such code may execute during package installation or when the installed module is imported.

Attack Path

  1. An attacker compromises a future replicate release, one of its transitive dependencies, or a package-index source used by the victim.
  2. The user follows the Skill documentation and runs pip install replicate.
  3. Pip resolves and downloads the compromised mutable package version.
  4. Attacker-controlled package code executes during installation or subsequent import.
  5. The malicious code operates with the permissions and environment access of the user running pip or Python.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the installing user. The accessible scope may include user-readable files, environment variables such as API tokens, project data, network access, and files writable by that user. The command does not itself obtain elevated privileges, so system-wide impact depends on whether the user executes it in a privileged environment.

Remediation
View remediation

Remediation Suggestions

  • Pin the package to a version that has been tested and reviewed.
  • Publish a lock file or hash-locked requirements file and install it with:
    bash
    python -m pip install --require-hashes -r requirements.txt
  • Include hashes for every direct and transitive dependency.
  • Recommend installation inside a dedicated virtual environment rather than the global Python environment.
  • Specify a trusted package index explicitly where appropriate.
  • Periodically scan pinned dependencies for known vulnerabilities and update them through a controlled review process.

T08 · Insecure Dependencies

Warning
Location
stable-diffusion.md:21
Finding

Unpinned Local Image-Generation Dependencies Create a Broad Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: stable-diffusion.md:21
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash
pip install diffusers transformers accelerate torch

Technical Analysis

This command installs four mutable top-level packages together with their potentially extensive transitive dependency trees. No versions, integrity hashes, lock file, trusted index, or isolated environment are specified.

The effective code installed by this instruction can therefore change independently of the reviewed Skill. This is particularly significant for large machine-learning stacks because they contain numerous dependencies and execute substantial native and Python code. A compromised release, dependency, package-index credential, mirror, or dependency-resolution result could introduce malicious code during installation or later model execution.

Attack Path

  1. An attacker compromises one of the named packages, a transitive dependency, or a package source configured in the victim's environment.
  2. The user runs the documented installation command.
  3. Pip resolves the newest compatible mutable dependency set and retrieves the compromised artifact.
  4. Malicious code executes during package installation, import, initialization, or subsequent image-generation operations.
  5. The payload accesses resources available to the user and may persist through modified user files or installed Python components.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the installing user's account. Potentially exposed resources include local image and project files, model caches, environment variables, provider API credentials, user-writable configuration, and outbound network access. If the command is run with administrative privileges or against a system Python installation, the impact could expand to system-wide package ...[truncated 79 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the unconstrained command with a tested, version-pinned dependency manifest.
  • Lock all transitive dependencies and require cryptographic hashes:
    bash
    python -m pip install --require-hashes -r requirements.txt
  • Provide platform-specific lock files where PyTorch or hardware-specific wheels differ.
  • Direct users to create and activate a dedicated virtual environment before installation.
  • Document the approved package index and avoid untrusted extra indexes.
  • Validate package signatures or provenance where supported.
  • Run dependency vulnerability and software-bill-of-materials scans as part of each release update.
  • Warn users not to run package installation with administrator or root privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (20)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · ideogram.md (reported line 19)May include surrounding context.

Setup

  1. Create account: https://leonardo.ai/
  2. Get API key from dashboard
  3. $5 free credit to start
bash

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · leonardo.md (reported line 10)May include surrounding context.

Setup

  1. Create account: https://leonardo.ai/
  2. Get API key from dashboard
  3. $5 free credit to start
bash

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill includes concrete examples that transmit user prompts and likely image-editing content to a third-party remote API, but it does not warn users that their data leaves the local environment. In an image-editing workflow, prompts and source images may contain sensitive or proprietary material, so omission of a disclosure can lead to unintended external sharing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The referenced endpoint is a third-party internet service, so use of this example inherently transmits request data outside the user's system boundary. In the context of an agent skill, that can expose confidential prompts, business assets, or embedded metadata if used without clear safeguards.

Content

Scanner excerpt · flux.md (reported line 34)May include surrounding context.

Text-to-Image

bash
curl -X POST "https://api.bfl.ai/v1/flux-pro" \
  -H "Authorization: Bearer $BFL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The referenced endpoint is a third-party internet service, so use of this example inherently transmits request data outside the user's system boundary. In the context of an agent skill, that can expose confidential prompts, business assets, or embedded metadata if used without clear safeguards.

Content

Scanner excerpt · flux.md (reported line 34)May include surrounding context.

Text-to-Image

bash
curl -X POST "https://api.bfl.ai/v1/flux-pro" \
  -H "Authorization: Bearer $BFL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

The edit example is more sensitive than plain text generation because image-editing requests may involve uploading existing user images, which can contain personal, confidential, or regulated information. Without any cautionary text, users may unknowingly send sensitive source material to an external provider.

Content

Scanner excerpt · flux.md (reported line 47)May include surrounding context.

Kontext Edit

bash
curl -X POST "https://api.bfl.ai/v1/flux-kontext-pro" \
  -H "Authorization: Bearer $BFL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · flux.md (reported line 107)May include surrounding context.

md
## Common Mistakes

- Calling `flux-2-pro` directly on BFL API (not an official endpoint)
- Using generation model IDs for edit endpoints without checking docs
- Assuming all provider aliases share identical parameters and response formats

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · gemini.md (reported line 25)May include surrounding context.

Basic REST Example

bash
curl -X POST \
  "https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-image-preview:generateContent?key=$GEMINI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · ideogram.md (reported line 30)May include surrounding context.

python
import requests

response = requests.post(
    "https://api.ideogram.ai/generate",
    headers={
        "Api-Key": IDEOGRAM_API_KEY,

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · ideogram.md (reported line 30)May include surrounding context.

python
import requests

response = requests.post(
    "https://api.ideogram.ai/generate",
    headers={
        "Api-Key": IDEOGRAM_API_KEY,

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · ideogram.md (reported line 31)May include surrounding context.

md
import requests

response = requests.post(
    "https://api.ideogram.ai/generate",
    headers={
        "Api-Key": IDEOGRAM_API_KEY,
        "Content-Type": "application/json"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The example sends both user prompts and a bearer API key to Leonardo's external cloud API, but the documentation does not warn users that their prompts and related metadata leave the local environment. This is risky because users may unknowingly submit sensitive or proprietary content to a third party and may not understand retention, logging, or privacy implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

The JSON payload is sent to an external image-generation endpoint together with authorization material, creating exposure of user-supplied content to a third party. In this skill's context that behavior is functional rather than covert, but the lack of disclosure and guardrails makes it a valid vulnerability from a privacy and data-handling standpoint.

Content

Scanner excerpt · leonardo.md (reported line 22)May include surrounding context.

python
import requests

response = requests.post(
    "https://cloud.leonardo.ai/api/rest/v1/generations",
    headers={
        "Authorization": f"Bearer {LEONARDO_API_KEY}",

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

The JSON payload is sent to an external image-generation endpoint together with authorization material, creating exposure of user-supplied content to a third party. In this skill's context that behavior is functional rather than covert, but the lack of disclosure and guardrails makes it a valid vulnerability from a privacy and data-handling standpoint.

Content

Scanner excerpt · leonardo.md (reported line 22)May include surrounding context.

python
import requests

response = requests.post(
    "https://cloud.leonardo.ai/api/rest/v1/generations",
    headers={
        "Authorization": f"Bearer {LEONARDO_API_KEY}",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The webhook example sends prediction lifecycle data to an external endpoint but does not warn users that prompts, outputs, metadata, or identifiers may be transmitted off-platform. In an AI image generation context, prompts can contain sensitive business, personal, or creative information, so omitting privacy guidance can lead to unintended data disclosure in production integrations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · setup.md (reported line 51)May include surrounding context.

test -n "$BFL_API_KEY" && echo "BFL configured"

text

Never ask users to paste secret values into chat.

## Memory Updates

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The document recommends storing request metadata including prompt hashes and result URLs/paths, which can affect user data retention and privacy. In this markdown file, there is no accompanying warning or disclosure that these logs may contain sensitive workflow information or should be handled per retention/privacy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This is a markdown file, so SQP-2 applies to omitted warnings about behaviors affecting privacy or data handling. The curl example posts user-provided text to an external Google endpoint, but the surrounding documentation does not mention that prompt contents are transmitted to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The setup instructs the agent to create a directory and initialize a memory file under the user's home directory without any explicit consent, disclosure, or confirmation step. While the writes are limited and not inherently exfiltrating data, silent persistence in a user home directory can violate user expectations, create privacy concerns, and normalize unauthorized filesystem modification by the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file includes example code that writes an image to disk via image.save("lion.png"), but the surrounding documentation does not mention that running the example will create a local file. For markdown files, the rule requires warnings when described behavior can affect user data or system state, and this file omits any such disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.