ClawHub
Back to skill

Security audit

Masonry: generate images and video with models across providers

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Masonry CLI integration for user-requested image and video generation, with expected token and external-service handling risks.

Install this only if you trust Masonry and the @masonryai/cli package. Prefer setting MASONRY_TOKEN through a secret or environment variable instead of pasting tokens into chat, avoid exposing private prompts or reference images unless you are comfortable with Masonry processing them, and remember that generation jobs may use subscription credits.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill instructs the operator to copy a raw authentication token and pass it on the command line via `masonry login --token <TOKEN>` without any warning that the token is sensitive. Command-line secrets are commonly exposed through shell history, process listings, logs, and transcripts, so this creates a real credential-handling weakness even if the skill is not overtly malicious. In this skill context, the risk is somewhat elevated because the workflow explicitly involves sending an auth URL to the user and then handling the returned token in an agent-mediated environment.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.