ClawHub
Back to skill

Security audit

Image Recognize

Security checks for vulnerabilities and agentic risk

Overview

This is a Baidu-based image recognition skill whose network use and image handling fit its stated purpose, but users should treat uploaded images and pasted API keys as sensitive.

Install only if you are comfortable sending selected images, fetched image URLs, and any visible text/faces in those images to Baidu Qianfan for processing. Prefer setting BAIDU_API_KEY in the environment rather than pasting it into chat, and avoid using private/internal URLs or sensitive photos, IDs, screenshots, medical images, or confidential documents.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill requires environment access and network use but does not declare permissions, which reduces transparency and weakens policy enforcement. In this context, the skill sends user-supplied images and uses an API key, so undeclared capabilities can lead to unexpected data egress and secret handling without clear user awareness.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The stated purpose is image recognition, but the documentation also indicates retrieving similar images and external reference resources, which expands behavior beyond the declared scope. This increases privacy and trust risk because user content or derived labels may be used to perform additional external lookups the user did not clearly authorize.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
Instructing the agent to extract API keys from prior conversation context is a secret-handling risk because it encourages reuse of credentials that may have appeared in unrelated contexts. This exceeds the image-recognition function and can normalize opportunistic credential collection and transmission to external services.

Description-Behavior Mismatch

Medium
Confidence
87% confidence
Finding
The code goes beyond simple image recognition and performs reverse-image style retrieval of similar web images and related metadata. That expands the skill’s capability and data exposure surface beyond the stated manifest scope, which can surprise users and return external content they did not explicitly request.

Context-Inappropriate Capability

Low
Confidence
91% confidence
Finding
The skill fetches arbitrary user-supplied URLs server-side before re-uploading the image to Baidu. This adds open network retrieval behavior that can be abused to access internal-only resources, cloud metadata endpoints, or otherwise unexpected URLs from the runtime environment.

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The code detects a risk-control intervention condition and prints a warning, but does not stop execution afterward. As a result, it may continue parsing and displaying recognition results despite the upstream service indicating processing should be blocked, undermining safety controls.

Vague Triggers

Medium
Confidence
79% confidence
Finding
An overly broad trigger can cause the skill to activate on generic image-related requests without adequate confirmation that the user wants third-party analysis. In this context, that is risky because images, URLs, or base64 content may be sent to Baidu unexpectedly, creating privacy and consent issues.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill does not clearly warn users that provided images or image URLs will be sent to a third-party service for processing. Because images may contain sensitive personal, biometric, or location information, the lack of notice undermines informed consent and increases privacy exposure.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill transmits image content to an external Baidu API, but the code provides no user-facing disclosure or confirmation at the point of use. If users provide sensitive images, local photos, IDs, or faces, this can cause unintended third-party data sharing.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
When a local path is supplied, the skill reads the file contents and base64-encodes them for transmission to an external service without an explicit warning. This creates a file-access plus external-sharing path that can expose sensitive local data if the user misunderstands what the tool does.

External Transmission

Medium
Category
Data Exfiltration
Content
}

    try:
        response = requests.post(api_url, json=payload, headers=headers, timeout=30)
        response.raise_for_status()
        result = response.json()
Confidence
86% confidence
Finding
The skill sends user-provided image data to an external network service, which is expected for cloud-based image recognition but still constitutes external data transmission. In this skill context, the danger is privacy and data-governance risk rather than covert exfiltration, especially because local files, faces, and text may be included.

Static analysis

No suspicious patterns detected.