ClawHub
Back to skill

Security audit

custom-infographic

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently creates infographics and its file, environment variable, and OpenRouter network use match that purpose.

Before installing, make sure you are comfortable sending the final assembled infographic prompt to OpenRouter. Avoid using sensitive documents unless secrets are removed, and verify OPENROUTER_API_KEY is only set in environments where you intend image generation to run.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill clearly requires sensitive capabilities—reading local files, accessing environment variables for `OPENROUTER_API_KEY`, and making outbound network calls—yet it declares no permissions. This creates a transparency and policy-enforcement gap: a host may allow the skill to run without surfacing the real trust boundary to users or reviewers, increasing the chance of unintended data access or exfiltration from user-provided files and environment-backed secrets.

Static analysis

No suspicious patterns detected.