ClawHub
Back to skill

Security audit

Image AI Kit

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward local image-processing and OCR skill that reads user-selected images and writes user-selected output files.

Before installing, review the Python dependencies and use a virtual environment. Only give it images you intend to process, and choose output paths carefully because the scripts can overwrite files at paths you provide.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
83% confidence
Finding
The skill documentation demonstrates code that writes output files (for example, generating 'output.jpg') and performs image processing without any declared permissions. Even if file output is expected for this skill’s purpose, the absence of an explicit permission declaration creates a mismatch between documented capabilities and the security model, which can enable unintended file writes or make review and sandboxing less reliable.

Static analysis

No suspicious patterns detected.