ClawHub
Back to skill

Security audit

儿童绘本生成器

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says: generate picture-book images through Baidu’s ERNIE image API and save them locally.

Install only if you are comfortable sending prompts to Baidu AI Studio. Use a Baidu/ERNIE Image API key, preferably from an environment variable, and write outputs to a dedicated folder or unique filename to avoid accidental overwrites.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
80% confidence
Finding
The documentation states that output files are written directly to a user-specified path and that same-name files are overwritten without confirmation. In an agent or automated workflow, this can cause unintended destruction of existing files if a path is reused, mis-specified, or influenced by untrusted input.

Static analysis

No suspicious patterns detected.