ClawHub
Back to skill

Security audit

Stock Images

Security checks for vulnerabilities and agentic risk

Overview

This stock-image helper is mostly a reference guide for image URLs, with cautions around third-party requests, one insecure HTTP example, and optional preference memory.

Safe to install for normal mockup and stock-image URL help. Avoid sending private, pre-signed, or sensitive image URLs to third-party services, especially the plaintext ReSmush.it example, and only allow preference memory if you explicitly want the agent to save it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
providers.md:214
Finding

Plaintext HTTP Used for Image Optimization Request

Content
View full analysis

Vulnerability Details

File Location: providers.md, line 214
Vulnerability Type: Plaintext transmission to an external API
Risk Level: Medium

Vulnerable Code

bash
curl -X POST "http://api.resmush.it/ws.php?img=https://example.com/image.jpg"

Technical Analysis

The documented command sends an image URL to an external optimization service over unencrypted HTTP. Because TLS is not used, network intermediaries can observe or modify both the submitted image URL and the service response.

If a user replaces the example URL with a private, unlisted, pre-signed, or otherwise sensitive image URL, its full value—including query parameters and access tokens—may be exposed in transit. An active man-in-the-middle attacker could also modify the request, redirect its target, or forge the API response.

This finding does not enable local code execution or privilege escalation by itself. Exploitation requires a user to follow the documented example while an attacker can observe or modify the relevant network traffic.

Attack Path

  1. A user follows the documented command and substitutes a real image URL for the example value.
  2. The command sends the complete URL to api.resmush.it over plaintext HTTP.
  3. An attacker positioned on the local network, proxy, ISP path, or another intermediary network segment intercepts the request.
  4. The attacker obtains the submitted image URL and any embedded query parameters or temporary access credentials.
  5. If those credentials remain valid, the attacker accesses the referenced image within the authorization scope of the exposed URL.
  6. Alternatively, an active attacker modifies the request or returns a forged API response, compromising the integrity of the optimization workflow.

Impact Assessment

The confidentiality and integrity of data transmitted through this example may be compromised. Potentially exposed data includes private image locations, filenames, query parameters, and pre-signed URL ...[truncated 282 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the plaintext endpoint with the provider's verified HTTPS endpoint:

    bash
    curl -X POST "https://api.resmush.it/ws.php?img=https://example.com/image.jpg"

  2. Confirm that the HTTPS endpoint is officially supported and that certificate validation succeeds without disabling TLS checks.

  3. If the provider does not support HTTPS, remove the example and recommend an image-optimization service that provides authenticated TLS.

  4. Warn users not to submit private, pre-signed, credential-bearing, or otherwise sensitive image URLs to third-party services.

  5. Prefer uploading non-sensitive content through a documented HTTPS API rather than placing access tokens or sensitive parameters inside a URL.

  6. Document the external disclosure clearly: the image URL is transmitted to and processed by a third party.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md
## Common Traps

- Using random URLs in production without caching → inconsistent images
- Hotlinking without checking terms → service blocks requests
- Using placeholder services for final production → unprofessional
- Requesting too large images → slow load times

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest says the skill sources free stock photos and placeholder images with direct URLs for Unsplash, Pexels, Pixabay, and Lorem Picsum. This file substantially expands scope by documenting additional placeholder services, avatar/faces services, icon and illustration sources, background-removal APIs, and image-optimization APIs that are not part of that stated provider set or limited purpose.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · providers.md (reported line 131)May include surrounding context.

Free stock photos and videos.

API (requires free key):

bash

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · providers.md (reported line 136)May include surrounding context.

bash
curl -H "Authorization: YOUR_API_KEY" \
  "https://api.pexels.com/v1/search?query=nature&per_page=10"

Pixabay

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The ReSmush.it example uses plain HTTP rather than HTTPS, which exposes requests to interception and tampering in transit. Because the endpoint accepts a remote image URL as a parameter, a man-in-the-middle could alter responses or observe requested resources, creating integrity and privacy risks if consumers copy this example.

Content

Scanner excerpt · providers.md (reported line 215)May include surrounding context.

bash
# ReSmush.it (no auth needed)
curl -X POST "http://api.resmush.it/ws.php?img=https://example.com/image.jpg"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs the agent to remember user preferences internally for future use without any disclosure, consent, or clear storage boundary. Even if the remembered data seems low sensitivity, silent retention creates a privacy risk because user behavior and preferences can be profiled or persisted beyond the immediate task without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill explicitly instructs users to fetch images from Unsplash via direct remote URLs, which causes client-side network requests to a third party and can expose IP address, user agent, referrer, and request timing metadata. While this is common behavior for stock-image sourcing and not inherently malicious, the lack of any privacy or network-disclosure note means users may unknowingly leak metadata or embed content that depends on an external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.