ClawHub
Back to skill

Security audit

Photo Editor Pro

Security checks for vulnerabilities and agentic risk

Overview

This is a simple photo-editing skill whose local file, cloud storage, and social upload references fit its stated purpose, but users should confirm before sending images to third-party services.

Before installing or using it, decide which folders or images it may edit, require confirmation before overwriting files, and only connect Google Drive, Dropbox, or social accounts when you intend to export or post images there.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill advertises local file saves plus cloud storage and social API uploads, but it does not disclose when image data may leave the local environment or that files may be modified and exported. In an agent context, that omission can cause users to authorize actions involving sensitive images without informed consent, increasing the risk of unintended data exposure or destructive edits.

Static analysis

No suspicious patterns detected.