ClawHub
Back to skill

Security audit

image generation gpt image

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed WellAPI image-generation skill that sends prompts and user-selected images to a third-party API and saves generated image files locally.

Install only if you are comfortable sending prompts, your WellAPI API key, and any selected image or mask files to WellAPI. Avoid uploading confidential, regulated, or proprietary images unless that use is approved, and remember that high-quality or large renders may consume paid quota.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill directs the agent to immediately send user prompts and local image files to the external WellAPI service without requiring an explicit disclosure or confirmation at the point of transfer. This is dangerous because users may not realize that sensitive prompt contents, metadata-bearing images, or private local files are being transmitted off-device to a third-party API, creating privacy and data-handling risk.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The example explicitly says the skill collects attached local files and sends them in a multipart request to https://wellapi.ai, but it does not provide a clear user-facing warning that local images are being uploaded to an external third-party service. This can lead to unintentional disclosure of sensitive or proprietary images, especially because the workflow encourages attaching local design assets and product photos.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.