Clawcap Avatar Equip

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:11 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent Gemini-based avatar accessory tool, but its bundled web/API service has review-worthy security gaps around unrestricted URL fetching, unauthenticated public access, and under-disclosed image handling.

Install or run this only in a controlled environment. Avoid exposing the web API publicly without authentication, trusted CORS origins, request-size limits, spending/quota controls, and strict URL allowlisting or removal of URL fetch support. Users should understand that avatar images and prompts are processed by Google Gemini and should not submit sensitive personal images unless they accept that third-party data flow.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: utils/image_utils.py:13

Finding

Server-Side Request Forgery Through Unrestricted Image URLs

Content

View full analysis

Image.Image: """Download and load an image from a URL.""" async with httpx.AsyncClient(timeout=10.0) as client: resp = await client.get(url) resp.raise_for_status() return Image.open(io.BytesIO(resp.content)).convert("RGBA") ``` ### Technical Analysis The API accepts a caller-controlled URL and passes it directly to `httpx.AsyncClient.get`. It does not restrict URL schemes or destination hosts, resolve and validate destination addresses, block private and reserved networks, or validate redirect targets. An attacker can therefore make the application issue requests from the server's network context. Potential destinations include loopback services, private network hosts, link-local addresses, and cloud instance metadata endpoints. The response must ultimately be parseable as an image for the entire image-processing workflow to succeed, but the initial network request occurs regardless, allowing network probing and interaction with image-returning internal services. Redirects are not explicitly enabled in this client construction, which limits redirect-based bypasses under the relevant `httpx` defaults, but it does not mitigate direct requests to prohibited destinations. ### Attack Path 1. An attacker sends a request to `/api/skill/alpha-equip`. 2. The `image_url` field is set to an internal or otherwise inaccessible destination, such as a loopback, private-network, or link-local URL. 3. The application passes the value directly to `httpx`. 4. The server connects to the destinati ...[truncated 835 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: utils/image_utils.py:13

Finding

Unbounded Image Downloads and Base64 Decoding Permit Resource Exhaustion

Content

View full analysis

Image.Image: """Download and load an image from a URL.""" async with httpx.AsyncClient(timeout=10.0) as client: resp = await client.get(url) resp.raise_for_status() return Image.open(io.BytesIO(resp.content)).convert("RGBA") def load_image_from_base64(b64_string: str) -> Image.Image: """Load an image from a Base64 string.""" if "," in b64_string: b64_string = b64_string.split(",", 1)[1] raw = base64.b64decode(b64_string) return Image.open(io.BytesIO(raw)).convert("RGBA") ``` ```python # mcp_server.py:84-86 img = load_image_from_base64(image_base64) validate_image(img) original_size = img.size ``` ### Technical Analysis Neither `image_url` nor `image_base64` has an encoded-byte limit. URL responses are buffered completely in `resp.content`, while Base64 input is decoded completely into memory. PIL then opens and converts the image before `validate_image` checks its dimensions. The dimension validation therefore occurs too late to prevent: - Very large HTTP response bodies. - Very large Base64 request bodies. - Images with extreme decompressed pixel counts. - Compressed image bombs. - Expensive mode conversion before rejection. The HTTP endpoint has a per-IP rate limit, but a small number of sufficiently large requests may still exhaust a worker. The MCP entry point does not implement equivalent ra ...[truncated 980 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: main.py:47

Finding

Unauthenticated Cross-Origin API Access Can Consume Operator Resources

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: static/index.html:625

Finding

Untrusted Gemini Metadata Is Rendered Through innerHTML

Content

View full analysis

ART_STYLE: ${fp.art_style}
> FACE_ANGLE: ${fp.face_angle}
> LIGHTING: ${fp.lighting_environment}
> LATENCY: ${data.metadata.processing_time_ms}ms `; ``` ### Technical Analysis The server accepts Gemini-generated strings after checking only that the expected keys exist. It does not enforce the documented enums, string-length limits, safe character sets, numeric types, or coordinate ranges. The frontend then interpolates those strings into `innerHTML`. Any HTML contained in `art_style`, `face_angle`, or `lighting_environment` will be parsed as markup rather than displayed as text. The metadata originates from a vision model processing attacker-supplied images. Images containing adversarial instructions or text can potentially influence model output. Exploitation requires the attacker to cause Gemini to emit syntactically valid JSON containing a browser-executable HTML payload, making reliabil ...[truncated 1160 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Mutable Unhashed Dependency Ranges Prevent Reproducible Trusted Installation

Content

View full analysis

=0.115.0 uvicorn[standard]>=0.32.0 google-genai>=1.51.0 Pillow>=10.0.0 numpy>=1.26.0 python-dotenv>=1.0.0 httpx>=0.27.0 python-multipart>=0.0.9 mcp[cli]>=1.0.0 slowapi>=0.1.9 ``` ```text # SKILL.md:64-65 - `GEMINI_API_KEY` environment variable - Install deps: `pip install -r requirements.txt` ``` ### Technical Analysis Every dependency uses a lower-bound constraint without an upper bound, exact version, lock file, or package hash. The same installation command can consequently resolve different packages over time. No typosquatted package, nonstandard package index, direct remote archive, or currently known malicious dependency was identified in the reviewed files. The weakness is that future package resolution is mutable and lacks integrity verification. Python packages can execute code during installation, import, or application startup. A compromised upstream release, an incompatible future major release, or an unexpected transitive dependency can therefore affect the Skill without any change to the audited repository. ### Attack Path 1. A dependency or transitive dependency publishes a compromised or unexpectedly incompatible future version. 2. A user later runs `pip install -r requirements.txt`. 3. The lower-bound constraint permits pip to select that new release. 4. The package is installed without comparison to a reviewed hash or lock file. 5. Package code executes during installation, import, or normal application operation with the user's privileges. ### Impact Assessment The possible impact depends on the behavior of a future compromised dependency and may include: - Execution of arbitrary code under the account installing or running the Skill. - Access to the `GEMINI_API_KEY` available in the process environmen ...[truncated 274 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (49)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

2. 配置 API Key

bash

cp .env.example .env
# 编辑 .env，填入你的 Gemini API Key
# 申请地址：https://aistudio.google.com/apikey

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description materially overstates and misrepresents behavior: it claims local image analysis, mask generation, and seamless inpainting, while the implementation reportedly relies on provided fingerprints, does not actually send the mask as implied, and transmits image data to an external Google GenAI service. This is dangerous because users may consent based on false assumptions about capability, privacy, and data flow, leading to unintended exposure of uploaded images and misplaced trust in output quality or isolation.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · core/inpainter.py (reported line 61)May include surrounding context.

python

f"Preserve the original face, expression, body, and background exactly as-is."
    )

    return prompt


async def inpaint_accessory(

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · main.py (reported line 33)May include surrounding context.

python

if not GEMINI_API_KEY:
    logger.error(
        "⚠️  GEMINI_API_KEY 未设置！"
        "请在 .env 文件中配置，或设置环境变量。"
    )

app = FastAPI(

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · mcp_server.py (reported line 75)May include surrounding context.

python

if not GEMINI_API_KEY:
    logger.error(
        "⚠️  GEMINI_API_KEY 未设置！"
        "请在 .env 文件中配置，或设置环境变量。"
    )

app = FastAPI(

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

• Category: Supply Chain
• Confidence: 70% confidence

Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly advertises external image processing via Gemini and a public demo endpoint but does not warn users that uploaded avatar images may be transmitted to third-party services or a remote server. This creates a real privacy and data-handling risk because avatars can contain biometric or identifying information, and users are not informed about where data goes, how long it is retained, or who can access it.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises no explicit tool scope or permissions, yet the surrounding behavior indicates access to environment variables and outbound network use. That mismatch is dangerous because users and hosting agents cannot accurately assess what the skill can access, and image data plus API credentials may be used in ways not transparently declared.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill omits a clear warning that user-uploaded images are sent to external Gemini services for analysis and generation. In an image-processing skill, that context makes the issue more serious because avatars may contain personal, identifying, or proprietary content, and users are likely to assume local processing unless told otherwise.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file’s docstrings and user-visible error/detail messages are written exclusively in Chinese, indicating a fixed language choice for API responses. There is no visible opt-in, negotiation, or documentation that the API is intentionally restricted to a Chinese-speaking context, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The handler fetches an image from a user-provided URL via load_image_from_url, which causes a network operation and may transmit request metadata or interact with external systems. In this code, there is no confirmation prompt, user-facing log/message, or inline warning/comment disclosing that remote retrieval occurs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file's natural-language documentation is written entirely in Chinese, while the user-facing prompt text is in English, with no indication that language is configurable or limited to a justified region-specific use case. Under the policy, hard-coding a language/locale choice without documenting user opt-in can be a language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill description claims accessory synthesis that automatically analyzes art style, lighting, and angle to seamlessly add headwear. In this file, the actual behavior is a generic call to a remote generative model with only a text prompt and the original image; it uses art_style from fingerprint but does not use mask_img, and there is no visible use of lighting or angle attributes to constrain the edit here. That creates a semantic gap between the advertised targeted synthesis behavior and the implementation shown.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation states that editing is guided by the head-top region and explicitly discusses the mask image, but the implementation only sends [prompt, original_img] to the model and never includes mask_img. This is not merely incomplete documentation: it directly acknowledges the mask parameter while describing behavior that implies spatially guided inpainting, which the current code does not perform.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file’s natural-language content is entirely in Chinese in the module docstring, function docstring, comments, and log message text, which imposes a specific language/locale on maintainers or users of logs without any opt-in or documented regional justification. The policy explicitly calls out forced language or locale as a violation when no choice or justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code sends user-supplied avatar image bytes to Google's Gemini API for remote processing, but nothing in this file indicates consent, disclosure, or privacy controls. Because avatars may contain personal or biometric information, undisclosed third-party transfer creates a real privacy and compliance risk, especially if callers assume all processing is local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module docstring is entirely in Chinese and presents the skill identity and description only in that language. This imposes a language choice on users or maintainers without offering an alternative or documenting that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The server instructions are written entirely in Chinese and direct behavior in a single language, with no indication that users may opt into another language or locale. The file does not document a region-specific or compliance-based justification for this constraint, so it appears to violate the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation states an absolute guarantee that the operation will only add accessories and will not alter the face, background, or composition. In the implementation, the result is produced by generate_mask(...) plus inpaint_accessory(...), with no explicit code-level checks that constrain edits away from facial regions or preserve background/composition exactly. That is an intent/documentation contradiction, not merely an omitted detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The tool processes user avatar images through AI pipeline components that likely rely on external model services, as suggested by the Gemini API key dependency, but provides no explicit notice, consent flow, or data-handling disclosure. This creates a privacy/security risk because sensitive biometric-like profile images may be transmitted off-box or to third-party providers without user awareness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The document declares lang="zh-CN", and the visible UI is predominantly Chinese-language without any apparent language selection or opt-in. The policy requires avoiding forced language or locale constraints unless the skill offers a choice or clearly documents a justified region-specific purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The frontend implements generic prompt-based image editing by accepting arbitrary text and posting image_base64 plus accessory_prompt to the backend, rather than enforcing automatic headwear-only augmentation. In the context of an image-manipulation skill, this increases misuse potential and can materially expand capability beyond the declared skill purpose, weakening trust and safety controls.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The page is described as a narrowly scoped hat/headwear tool, but the UI exposes a freeform prompt and sends it directly as accessory_prompt, enabling broader image editing behavior than users or reviewers may expect. This scope mismatch is dangerous because it can bypass product-policy assumptions, safety review boundaries, or downstream moderation rules that were designed only for constrained avatar headwear synthesis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The application uploads user-provided avatar images and receives generated image content without presenting a user-facing privacy notice about transmission, processing, retention, or third-party handling. Because avatar images may contain faces or other personal data, users may unknowingly submit sensitive biometric-like content to remote processing services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The function downloads content from a user-supplied URL via httpx, which is a network operation that can transmit user-provided data to external systems. In this file, there is no confirmation prompt, user-facing log/print, or warning comment/docstring explaining the privacy or network implications of fetching remote content.

Content

No source excerpt is available for this finding.