ClawHub
Back to skill

Security audit

Ms Ai

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform its stated ModelScope AI tasks, but it has avoidable security risks around API-key logging, third-party data upload, and trusting remote image download URLs.

Review before installing. Use this only if you are comfortable sending prompts, images, OCR targets, and chat history to ModelScope, and avoid sensitive files unless approved. Consider patching the API-key prefix logging, adding URL and image-size validation for downloads, and installing dependencies in an isolated pinned environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/common.py:45
Finding

Partial API Key Disclosure Through Diagnostic Logs

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate.py:157
Finding

Unvalidated Server-Provided Image Download URL

Content
View full analysis
str: resp = requests.get(url, timeout=60) resp.raise_for_status() img = Image.open(BytesIO(resp.content)) img.save(output_path) return output_path def _generate_one(api_key: str, model: str, prompt: str, output_path: str, width: int, height: int, image_urls, loras) -> dict: """尝试用指定 key + model 生成，返回统一格式""" try: task_id = submit_task(api_key, prompt, model, width, height, loras, image_urls) print(f" 📋 任务 ID: {task_id}", file=sys.stderr) print(f" ⏳ 等待生成中...", file=sys.stderr) result = poll_task(api_key, task_id) output_url = result["output_images"][0] saved_path = download_image(output_url, output_path) ``` ### Technical Analysis The image-generation API controls `result["output_images"][0]`, and the client passes that value directly to `requests.get`. The code does not validate: - The URL scheme - The destination hostname - Resolved IP addresses - Redirect destinations - Whether the destination is private, loopback, link-local, or otherwise internal - The response content type - The response body size - The decoded image dimensions Consequently, a compromised ModelScope response, compromised upstream service, or otherwise manipulated task result could make the client issue an HTTP request to a destination selected by the response provider. Because `requests` follows redirects by default, an initially acceptable URL could also redirect to an internal destination. The request is primarily blind because the response is decoded as an image rather than returned to the API. Nevertheless, requests to internal services may trigger state-changing endpoints, and response behavior can pot ...[truncated 1729 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:21
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

代码行为与描述部分重合：它确实通过 ModelScope API 实现了文生图、图生图，并支持在失败/限速场景下结合 key 与模型进行轮换，这与声明中的一部分一致。但声明将技能描述为同时支持‘析图/视觉理解’和‘生文/文本生成’，而该代码仅调用 v1/images/generations 图像生成接口，处理输入图片也是为了图生图编辑，并没有任何图像理解、OCR、描述生成、问答或文本生成相关接口调用与逻辑。因此声明的能力范围明显大于实际代码实现，属于描述与实际行为不一致。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description claims a multi-capability skill for image generation, image editing, visual understanding, and text generation. However, this code chunk only performs text/chat generation against a chat completions endpoint. It accepts text prompts, optional chat history, streams text responses, and rotates across API keys and text models when rate-limited. There is no image input handling, no image output generation, no vision endpoint usage, and no image-processing logic. The auto-rotation claim is supported, but the declared overall capability set is materially broader than the actual behavior shown in this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code matches only the '析图/视觉理解' portion of the description and does include model/key rotation behavior. However, the declared purpose describes a multi-function skill for image generation, image editing, visual understanding, and text generation. This specific code chunk only performs image analysis by packaging an image plus prompt to vision-capable chat models and returning textual analysis. There is no implementation for creating images from text, transforming images, or general text-generation workflows unrelated to image input. Therefore the description overstates the implemented capabilities of this code chunk in a materially significant way.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/text.py (reported line 7)May include surrounding context.

python
用法:
  单轮: python3 text.py --prompt "解释量子计算"
  多轮: python3 text.py --prompt "继续" --history history.json
  指定模型: python3 text.py --prompt "你好" --model kimi
  流式: python3 text.py --prompt "写一首诗" --stream
"""

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README advertises image upload, OCR, visual analysis, and text generation backed by an external AI service, but it does not warn users that prompts and uploaded images may be transmitted to a third-party API. This can lead to unintentional disclosure of sensitive personal, corporate, or regulated data, especially because OCR and image analysis often involve documents, screenshots, or photos containing secrets.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to install/run tooling via npx clawhub without pinning an exact version. This creates a supply-chain risk because users may fetch whatever version is current at execution time, including a compromised or unexpectedly changed release.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill documentation describes capabilities that require access to environment variables, local files, and outbound network requests, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an overbroad and implicit trust boundary: a host may grant more capability than users or reviewers expect, making secret exposure, unintended file writes, or external API calls harder to govern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The natural-language description and operating instructions force a specific language/locale for users and agents consuming the skill. Under the policy, locale constraints should either be optional, justified as region-specific, or provide a language choice; this file does not do so.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code file contains user-facing natural-language strings and documentation entirely in Chinese, including setup/error guidance, which effectively imposes a specific language on users. The policy for SQP-3 flags language or locale constraints when the skill does not provide an explicit user choice or opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

When used in image-to-image mode, local image files are base64-encoded and sent to the external ModelScope API, but the script provides no explicit user-facing disclosure or confirmation at the point of upload. This can cause unintentional exfiltration of sensitive local images, especially in an agent/skill context where users may not realize their files are being transmitted off-host.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/text.py (reported line 78)May include surrounding context.

python
}

    try:
        resp = requests.post(
            f"{BASE_URL}chat/completions",
            headers=headers, json=payload, timeout=120, stream=stream,
        )

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script sends the user prompt and any loaded chat history to a third-party API endpoint, but it does not provide an explicit user-facing privacy notice or confirmation step before transmission. In a skill context, users may unknowingly include sensitive data in prompts or history files, causing unintentional disclosure to an external provider.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/vision.py (reported line 70)May include surrounding context.

python
}

    try:
        resp = requests.post(f"{BASE_URL}v1/chat/completions", headers=headers, json=payload, timeout=120)

        if resp.status_code == 429:
            return {"status": "rate_limit"}

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The docstring, help text, and user-facing messages are presented only in Chinese, with no indication that users may choose another language. This creates a locale/language policy issue under the rule because the skill enforces a specific language rather than offering a choice or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

When --output is used, the full conversation is written to disk as JSON without any explicit warning that potentially sensitive prompts and model responses will be persisted locally. This can expose private data to other local users, backups, or later unintended reuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.