ClawHub
Back to skill

Security audit

Pollinations AI

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but its API-key handling and file-output controls create review-worthy risks before installation.

Review before installing. Use a low-privilege API key, avoid private prompts, keep outputs in a trusted directory that other users cannot write to, and avoid --telegram unless you intentionally want the generated image and prompt-derived caption sent to that chat. Prefer a version that authenticates with headers, hardens output path handling, and pins dependencies.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
pollinations_image_gen.py:91
Finding

Pollinations API Key Exposed in URL Query Parameters

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
pollinations_image_gen.py:111
Finding

Output Directory Restrictions Can Be Bypassed Through Symbolic Links

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Dependencies Are Installed Without Exact Version or Integrity Pinning

Content
View full analysis
=2.28.0", "Pillow>=9.0.0" ] ``` ### Technical Analysis The installation instructions and `requirements.txt` allow pip to select mutable package versions from the configured package index. The minimum-version constraints in `_meta.json` also permit any later release and do not verify package integrity. The package names are consistent with well-known projects, and no typosquatting or intentionally malicious package was identified. Nevertheless, the absence of exact pins and cryptographic hashes makes installations non-reproducible and increases exposure to future compromised, malicious, or unexpectedly incompatible releases. `Pillow` is declared as a dependency but is not imported by any of the reviewed Python scripts. This unnecessarily increases the dependency and supply-chain attack surface. ### Attack Path 1. A user follows the documented installation command or installs dependencies from `requirements.txt`. 2. Pip queries the configured package index and resolves whichever matching versions are available at that time. 3. If a future release, package-index account, package mirror, or local package source is compromised, the affected distribution is downloaded. 4. Package installation code or imported package code executes with the privileges of the user performing the installation or running the Skill. ### Impact Assessment A compromised dependency could execute arbitrary code with the privileges of the installing or invoking user. That could expose local files, environment variables such as `POLLINATIONS_API_KEY`, or other credentials accessible to that account. No malicious d ...[truncated 185 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (15)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: pollinations-ai
description: Generate images, music, and video using Pollinations AI API. Use when: (1) User wants to create images from text prompts, (2) User wants to generate music/audio, (3) User wants to create videos from text, (4) Using AI image generation with models like flux, zimage, nanobanana.
---

# Pollinations AI - Image, Music & Video Generation

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill mixes and relies on Chinese/Cantonese user-facing messages such as the docstring, error text, and CLI help without any opt-in or alternative locale. This creates a language policy issue because the skill assumes a specific language for interaction rather than offering a user-selectable or documented locale.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This image-generation skill includes an additional outbound messaging capability that can send generated files and prompt-derived captions to Telegram. Even though it requires an explicit flag and environment variable, bundling unrelated exfiltration functionality into the same skill expands the data-exposure surface and makes accidental or unauthorized transmission more plausible.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · pollinations_image_gen.py (reported line 33)May include surrounding context.

python
if caption:
            cmd.extend(["--message", caption])
        
        result = subprocess.run(cmd, capture_output=True, text=True)
        if result.returncode == 0:
            print(f"Image sent via Telegram: {image_path}")
            return True

Tainted flow: 'cmd' from os.getenv (line 29, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · pollinations_image_gen.py (reported line 33)May include surrounding context.

python
if caption:
            cmd.extend(["--message", caption])
        
        result = subprocess.run(cmd, capture_output=True, text=True)
        if result.returncode == 0:
            print(f"Image sent via Telegram: {image_path}")
            return True

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · pollinations_image_gen.py (reported line 63)May include surrounding context.

python
payload = {
            "model": "openai",
            "messages": [
                {"role": "system", "content": "Rewrite as high-quality English image prompt. Raw text only."},
                {"role": "user", "content": prompt}
            ]
        }

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The system message explicitly instructs the model to rewrite user input as an English image prompt. This imposes a specific language choice in natural-language behavior without offering the user an opt-in or alternative locale, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The enhance_prompt feature transmits user-supplied prompt content to an external API, which can expose sensitive or proprietary text if users include it in their prompts. In a skill context, outbound transmission of user input is a real data-leak risk unless clearly disclosed and consented to.

Content

Scanner excerpt · pollinations_image_gen.py (reported line 68)May include surrounding context.

python
]
        }

        response = requests.post(self.text_api_url, json=payload, headers=headers)
        response.raise_for_status()
        
        data = response.json()

Tainted flow: 'safe_output' from os.getenv (line 208, credential/environment) → shutil.copy (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · pollinations_image_gen.py (reported line 210)May include surrounding context.

python
import shutil
            safe_output = os.path.join(workspace_path, "outputs", os.path.basename(args.output))
            os.makedirs(os.path.dirname(safe_output), exist_ok=True)
            shutil.copy(args.output, safe_output)
            args.output = safe_output
            print(f"Copied to allowed directory: {safe_output}")

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file contains docstrings, error messages, and CLI help text in Traditional Chinese/Cantonese only, such as the prompt help and validation error text. This imposes a language choice on users without any opt-in or alternative locale support, which matches the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The file is presented as an image generator CLI, but enhance_prompt sends user prompts to a chat-completions endpoint to rewrite them before image generation. This adds a distinct text-generation and outbound data-sharing capability that is not obviously required by a minimal image-generation tool, especially when no manifest declares it.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency 'requests' is not version-pinned, which makes builds non-reproducible and can cause the environment to install an unexpectedly vulnerable or incompatible release. In a security context, leaving versions open also makes it impossible to verify whether known vulnerable versions are excluded.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
requests
Pillow

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
89% confidence
Finding

The manifest references 'requests' without a version while the package has multiple known advisories across its release history. Because the version is unspecified, the project may install a vulnerable release and reviewers cannot determine from this file alone whether the dependency is safe.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency 'Pillow' is not version-pinned, so installations may resolve to different versions over time, including versions with known security flaws or breaking behavior. This weakens supply-chain control and prevents reliable auditing of what code will actually be installed.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
requests
Pillow

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
89% confidence
Finding

The manifest references 'Pillow' without a fixed version even though Pillow has had multiple security advisories, including memory-safety and resource-consumption issues. Without pinning, deployments may pull an affected version, especially in fresh or rebuilt environments.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.