ClawHub
Back to skill

Security audit

Renderful AI

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated Renderful image/video purpose, but it documents autonomous crypto payments without clear user approval, limits, or cost controls.

Review before installing. Use this only if you are comfortable sending prompts to Renderful and potentially paying for generation. Do not enable the x402 wallet preference unless you use a dedicated low-balance wallet and require explicit approval for each payment, including amount, network, recipient, and fees.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:132
Finding

Autonomous Cryptocurrency Payments Without Human Approval

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 132-137
Vulnerability Type: Autonomous financial authorization exceeding least privilege
Risk Level: High

bash
# Agent can pay directly without human approval
export RENDERFUL_X402_WALLET="your_agent_wallet"
export RENDERFUL_PREFER_X402="true"

Technical Analysis

The Skill explicitly instructs an Agent to configure a cryptocurrency wallet and enables x402 payments without human approval. Autonomous payment authority is not the minimum privilege necessary to submit image or video generation requests.

No controls are specified for transaction value, cumulative spending, recipient validation, supported networks, credential scope, or per-transaction confirmation. The required format of RENDERFUL_X402_WALLET is also undocumented, making it unclear whether it contains a public address or sensitive signing credentials. Although the audited file does not itself contain a wallet secret or executable payment implementation, following these instructions could grant an Agent financial authority with insufficient safeguards.

Attack Path

  1. A user asks the Agent to generate an image or video.
  2. The Agent follows the Skill and configures RENDERFUL_X402_WALLET.
  3. The Agent enables RENDERFUL_PREFER_X402, preferring the autonomous payment flow.
  4. The generation service returns an HTTP 402 payment requirement.
  5. The Agent authorizes a cryptocurrency payment without first showing the user the asset, amount, network, recipient, or cumulative cost.
  6. Repeated or unexpectedly expensive requests may cause additional irreversible wallet spending.

Exploitation depends on the external service and Agent runtime implementing the described x402 payment flow. The audit found no local payment implementation, so it cannot establish the exact wallet credential type or transaction limits.

Impact Assessment

The affected privilege is authority to spen ...[truncated 652 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the instruction that the Agent may pay without human approval.
  • Require explicit, transaction-specific user authorization before every payment.
  • Before requesting approval, display the exact amount, asset, blockchain network, recipient, service description, and applicable fees.
  • Enforce hard limits for each transaction, each session, and cumulative daily spending.
  • Use a dedicated, low-balance wallet rather than a user's primary wallet.
  • Restrict payment credentials to the Renderful service and supported networks wherever the wallet implementation permits it.
  • Never request, store, log, or transmit seed phrases or raw private keys.
  • Clearly document whether RENDERFUL_X402_WALLET expects a public address, a scoped payment token, or another credential type.
  • Reject transactions whose destination, network, asset, or amount differs from the values the user approved.
  • Maintain an auditable payment record and provide a reliable way to disable autonomous payment configuration.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Authentication

Get API key from https://renderful.ai/dashboard

bash
# Set as environment variable

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The x402 section explicitly states that the agent can pay directly without human approval, but the skill does not present a clear warning or consent requirement to the user. This creates a real risk of unauthorized or surprising financial transactions, especially when combined with broad triggers and autonomous agent execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes very generic phrases like "generate image" and "generate video," which can cause the skill to activate in situations where the user did not intend to use this third-party paid service. In this skill's context, unintended invocation is more dangerous because activation can lead directly to outbound API calls and potentially paid generation requests.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

API Base URL

text
https://api.renderful.ai/v1

Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

API Base URL

text
https://api.renderful.ai/v1

Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The referenced URL is part of an actual POST request that transmits prompt content and credentials to an external service. In this context, the risk is not the URL alone but the documented action flow that enables remote processing and possible charges.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Generate an Image

bash
curl -X POST https://api.renderful.ai/v1/generate \
  -H "Authorization: Bearer $RENDERFUL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

The referenced URL is part of an actual POST request that transmits prompt content and credentials to an external service. In this context, the risk is not the URL alone but the documented action flow that enables remote processing and possible charges.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Generate an Image

bash
curl -X POST https://api.renderful.ai/v1/generate \
  -H "Authorization: Bearer $RENDERFUL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The video example sends user content to an external generation API and may create higher-cost jobs than images. This is expected behavior, but it remains a true security concern because it combines external data sharing with potentially billable compute.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Generate a Video

bash
curl -X POST https://api.renderful.ai/v1/generate \
  -H "Authorization: Bearer $RENDERFUL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

This URL appears in a runnable example that would submit a generation request to the provider. Because the request can send user prompts externally and potentially incur charges, it is a real issue in need of user-awareness controls rather than a harmless reference.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

Simple Image

bash
curl -X POST https://api.renderful.ai/v1/generate \
  -H "Authorization: Bearer $RENDERFUL_API_KEY" \
  -d '{"model":"flux-dev","prompt":"a cute cat","width":512,"height":512}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

This URL appears in a runnable example that would submit a generation request to the provider. Because the request can send user prompts externally and potentially incur charges, it is a real issue in need of user-awareness controls rather than a harmless reference.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

Simple Image

bash
curl -X POST https://api.renderful.ai/v1/generate \
  -H "Authorization: Bearer $RENDERFUL_API_KEY" \
  -d '{"model":"flux-dev","prompt":"a cute cat","width":512,"height":512}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

This example documents a concrete outbound request for video generation to a third-party API. The context makes it more sensitive because video jobs may be more expensive and the skill separately advertises autonomous payment support.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

Video with Specific Settings

bash
curl -X POST https://api.renderful.ai/v1/generate \
  -H "Authorization: Bearer $RENDERFUL_API_KEY" \
  -d '{
    "model": "kling-1.6",

Static analysis

No suspicious patterns detected.