ClawHub
Back to skill

Security audit

纯血万相冰箱盲盒

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims, but users should treat fridge photos as private because they are sent to Alibaba DashScope for AI processing.

Install only if you are comfortable sending fridge photos and prompts to Alibaba DashScope or any WAN_API_URL you configure. Crop out private items, medications, labels, faces, or location clues before use, and use a limited API key in a virtual environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs users to upload refrigerator photos and later states that it requires an external DashScope API key, but it does not clearly warn that the image will be transmitted to a third-party cloud service. This is a real privacy/transparency issue because refrigerator photos can reveal personal habits, medications, family details, or other sensitive household information, and users are not given informed consent at the point of upload.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill base64-encodes the user's fridge photo and sends it to an external multimodal API for ingredient recognition without an explicit in-flow disclosure or consent gate. Fridge photos can reveal sensitive household information such as medications, brands, living conditions, and other private items, so silent third-party transmission creates a real privacy risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The recipe-generation path also uploads the fridge image to an external API, again without clearly warning the user at the point of use. Because this is a consumer-facing cooking utility, users may reasonably expect only local processing; undisclosed cloud transmission of personal photos is therefore security-relevant in the privacy sense.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.