ClawHub
Back to skill

Security audit

Vision

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it sends a user-selected image to a configured vision model so a non-vision agent can describe or OCR it.

Install only if you are comfortable sending chosen images and prompts to the configured VISION_BASE_URL. Prefer a local endpoint for private screenshots, documents, receipts, credentials, or regulated data, and review .claude/settings.json or environment variables so you know which service receives the image.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs the agent to read environment variables, access local files, and make network requests, but it does not declare those permissions explicitly. This creates a transparency and policy-enforcement gap: users may invoke the skill without realizing it can exfiltrate local image contents and configuration to an external endpoint.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README states that images will be automatically sent to an OpenAI-compatible vision model, including remote services, but does not give a prominent privacy warning about possible transmission of sensitive screenshots, documents, or local image contents to third-party endpoints. In a skill specifically designed to inspect screenshots and photos, this creates a real risk of unintentional data disclosure because users may assume local analysis or may not appreciate that confidential visual data leaves their environment.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill says it can 'see' images by sending them to a configurable OpenAI-compatible vision model, but it does not prominently warn users that local images, screenshots, and OCR content may be transmitted to a remote service. This is dangerous because users may provide sensitive screenshots, receipts, or documents under the assumption processing is local, causing unintended disclosure of confidential data.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This script sends the provided image, and for local files the full base64-encoded contents, to a configurable remote OpenAI-compatible endpoint without any explicit consent prompt, trust boundary check, or prominent warning at send time. In this skill’s context, that is security-relevant because users may pass screenshots, scanned documents, or other sensitive local images assuming the assistant is only processing them locally, while the tool silently exfiltrates that content to whatever endpoint is configured.

Static analysis

No suspicious patterns detected.