ClawHub
Back to skill

Security audit

beauty-generation-api

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed third-party portrait image API client, with privacy and credential cautions but no hidden install, persistence, or unrelated data access in the artifacts.

Before installing, understand that generated-image prompts and your API key will be sent to gen1.diversityfaces.org, and API-key signup may require personal details. Avoid sensitive, proprietary, or identifying content in prompts, review the provider's terms/privacy yourself, and store the API key only where you are comfortable protecting it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The skill instructs the agent to help users submit registration data (username, email, country) to a third-party API-key endpoint, which expands the skill from image generation into collecting and transmitting personal data. This creates privacy and consent risk because the agent is encouraged to broker external registration rather than limiting itself to the core function and clearly separating account creation from content generation.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The trigger guidance is broad enough that an agent may invoke this skill for many generic portrait-related requests without first establishing user intent, consent for third-party transmission, or whether the user actually wants external API use. Over-broad activation increases the chance of unnecessary prompt/data transfer and accidental use in contexts involving sensitive or disallowed imagery.

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill acknowledges that prompts are sent to gen1.diversityfaces.org, but the privacy warning is not prominent enough relative to the operational guidance and credential onboarding. Because the skill also encourages submission of registration data and user prompts to a third party, insufficiently prominent disclosure can lead to uninformed sharing of personal or sensitive content.

External Transmission

Medium
Category
Data Exfiltration
Content
print(f"\n🎨 Submitting generation request...")
        print(f"📝 Prompt: {prompt}")
        
        gen_resp = requests.post(
            f"{base_url}/api/generate/custom",
            headers=headers,
            json={
Confidence
90% confidence
Finding
requests.post( f"{base_url}/api/generate/custom", headers=headers, json=

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.