ClawHub
Back to skill

Security audit

Image Generator

Security checks across malware telemetry and agentic risk

Overview

This image-generation skill is mostly coherent, but it can auto-install an additional unreviewed workflow skill and sends generation work to a remote service.

Review the AnyGen CLI and the separate anygen-workflow-generate skill before allowing installation. Use a scoped or revocable AnyGen API key, avoid confidential prompts or private assets unless you accept AnyGen processing them, and be aware that the skill may change the agent's installed skill set.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger description is extremely broad and covers many generic requests involving creation or design, which increases the chance the skill will activate in situations beyond narrowly intended image generation tasks. Over-broad routing can cause unintended tool use and may send user prompts or assets to an external service without clear user awareness, especially given this skill explicitly uses a server-side provider.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill states that image generation occurs server-side at www.anygen.io, but it does not clearly warn that user prompts, instructions, and possibly uploaded assets may be transmitted to a remote third-party service. This creates a data exposure risk because users may provide sensitive content under the assumption the work is handled locally or without external sharing.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.