ClawHub
Back to skill

Security audit

Pollinations AI

Security checks across malware telemetry and agentic risk

Overview

This skill does what it advertises: it generates media through Pollinations AI, with expected external API use, local output files, and optional Telegram sharing.

Install only if you are comfortable sending prompts, generation parameters, API key-authenticated requests, and generated media to Pollinations AI. Avoid confidential or regulated content in prompts, pin dependencies for production use, and enable Telegram sharing only for an intended chat ID.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tainted flow: 'safe_output' from os.getenv (line 208, credential/environment) → shutil.copy (file write)

Medium
Category
Data Flow
Content
import shutil
            safe_output = os.path.join(workspace_path, "outputs", os.path.basename(args.output))
            os.makedirs(os.path.dirname(safe_output), exist_ok=True)
            shutil.copy(args.output, safe_output)
            args.output = safe_output
            print(f"Copied to allowed directory: {safe_output}")
Confidence
71% confidence
Finding
The destination path for shutil.copy is derived from OPENCLAW_WORKSPACE without validation, so a malicious or untrusted environment value can redirect file writes outside the intended workspace. In agent or multi-tenant execution contexts, trusting environment-controlled filesystem roots can enable unauthorized file creation or overwrite in attacker-chosen locations.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests
Pillow
Confidence
98% confidence
Finding
The dependency 'requests' is unpinned, so installs may resolve to different versions over time, including versions with newly introduced bugs or incompatible behavior. This weakens build reproducibility and increases supply-chain risk because a vulnerable or malicious release could be pulled implicitly.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests
Pillow
Confidence
99% confidence
Finding
The dependency 'Pillow' is unpinned, allowing arbitrary future versions to be installed, which is especially risky given Pillow's history of critical security issues. This creates a supply-chain exposure and makes deployments non-reproducible, so a bad or vulnerable release could be introduced without any code changes.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
97% confidence
Finding
The file declares 'requests' without any version constraint, and static analysis indicates multiple known advisories affect this package across versions. Without pinning to a patched release, installations may select a vulnerable version, potentially exposing credential leakage, TLS/verification issues, or other client-side security flaws depending on usage.

Known Vulnerable Dependency: Pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical
Category
Supply Chain
Confidence
99% confidence
Finding
The file declares 'Pillow' without a version, and the package has numerous known vulnerabilities, including issues that can lead to denial of service or even arbitrary code execution when processing crafted image files. If this skill handles untrusted images or files, the lack of a pinned, patched version substantially increases the chance of exploitable compromise.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.