ClawHub
Back to skill

Security audit

Image To 3d Pipeline

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned overall, but it under-discloses a second 3D provider and includes examples that can make unbounded paid API calls.

Review before installing. Use this only with non-sensitive images you are allowed to upload, confirm which provider you intend to use, and avoid running the Meshy snippets unless you explicitly configure Meshy and add polling, timeout, batch-size, and cost controls.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:124
Finding

Cross-Provider Task Handling Uses an Unvalidated Task Identifier

Content
View full analysis
Remediation
View remediation
0)') || { echo "The API did not return a valid task ID" >&2; exit 1; } ``` - Validate the identifier against the provider's documented character set and length before placing it in a URL. - Handle authentication failures, rate limits, malformed responses, and provider-specific terminal states explicitly. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:135
Finding

Unbounded API Polling Can Cause Indefinite Resource Consumption

Content
View full analysis
Remediation
View remediation
&2 exit 1 fi ``` ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:178
Finding

Batch Processing Launches Unbounded Paid Requests and Constructs JSON Unsafely

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs users to submit image URLs and process images through third-party APIs without clearly warning that uploaded product images may be transmitted to external vendors. In a pipeline handling user-supplied media, missing disclosure can lead to unintentional sharing of sensitive or proprietary product imagery and associated metadata.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The referenced Replicate endpoint represents outbound transfer of user-supplied content to a third-party API. In this context the transmission is functional rather than overtly malicious, but it is still security-relevant because it can expose private images and consume paid API resources.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

1. 提交 Tripo3D 任务

bash
curl -X POST "https://api.replicate.com/v1/predictions" \
  -H "Authorization: Token $TRIPOSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The referenced Replicate endpoint represents outbound transfer of user-supplied content to a third-party API. In this context the transmission is functional rather than overtly malicious, but it is still security-relevant because it can expose private images and consume paid API resources.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

1. 提交 Tripo3D 任务

bash
curl -X POST "https://api.replicate.com/v1/predictions" \
  -H "Authorization: Token $TRIPOSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

Polling the Replicate status endpoint continues interaction with an external provider using an API token. The call itself is less sensitive than image submission, but it still confirms job identifiers and relies on third-party infrastructure and credentials.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

2. 查询任务状态

bash
curl "https://api.replicate.com/v1/predictions/pred_abc123" \
  -H "Authorization: Token $TRIPOSR_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The remove.bg step sends the source image URL to another third-party service, increasing the number of external processors that receive user content. Chaining multiple vendors compounds privacy, compliance, and availability risks, especially without explicit notice.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

bash
# 使用 remove.bg API
curl -X POST "https://api.remove.bg/v1.0/removebg" \
  -H "X-Api-Key: $REMOVE_BG_API_KEY" \
  -F "image_url=https://example.com/product.jpg" \
  -F "size=auto" \

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation claims the pipeline uses Tripo3D via Replicate, but the implementation examples switch to Meshy polling and batch APIs with an undeclared MESHY_API_KEY. This inconsistency can cause users or agents to send images and credentials to an unintended third-party service, increasing the risk of accidental data disclosure, billing misuse, and misconfiguration.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This submission example again sends image-related data to Replicate, but the payload structure is inconsistent with the earlier documented format, which increases the chance of accidental misrouting or developer confusion. External transmission itself is expected, yet the inconsistent example raises operational and privacy risk.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

bash
# 提交任务
TASK_RESPONSE=$(curl -s -X POST "https://api.replicate.com/v1/predictions" \
  -H "Authorization: Token $TRIPOSR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The polling loop queries Meshy with a MESHY_API_KEY even though the skill metadata only declares TripoSR/Replicate-related keys. This hidden provider dependency can cause agents to use undeclared secrets or unexpectedly disclose task metadata to a separate service.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md
# 轮询结果（每20秒检查一次）
while true; do
  STATUS=$(curl -s "https://api.meshy.ai/v2/image-to-3d/$TASK_ID" \
    -H "Authorization: Bearer $MESHY_API_KEY" | jq -r '.status')
  
  if [ "$STATUS" == "SUCCEEDED" ]; then

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The Meshy batch submission sends multiple image URLs externally and does so in the background, which can amplify accidental data disclosure and cost exposure. Because the provider and key are not properly declared, the skill context makes this more dangerous than a clearly documented single-provider integration.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

bash
# 批量生成（需要企业版 API）
for img in "${images[@]}"; do
  curl -X POST "https://api.meshy.ai/v2/image-to-3d" \
    -H "Authorization: Bearer $MESHY_API_KEY" \
    -d "{\"image_url\": \"$img\", \"enable_pbr\": true}" &
done

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The Meshy batch submission sends multiple image URLs externally and does so in the background, which can amplify accidental data disclosure and cost exposure. Because the provider and key are not properly declared, the skill context makes this more dangerous than a clearly documented single-provider integration.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

bash
# 批量生成（需要企业版 API）
for img in "${images[@]}"; do
  curl -X POST "https://api.meshy.ai/v2/image-to-3d" \
    -H "Authorization: Bearer $MESHY_API_KEY" \
    -d "{\"image_url\": \"$img\", \"enable_pbr\": true}" &
done

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The manifest description is presented in Chinese and the document continues primarily in Chinese, with no indication that users may choose another language. This can be a natural-language policy concern when a skill effectively forces a locale or language without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest description is written entirely in Chinese, which can function as a language constraint in user-facing skill metadata. There is no indication that users may choose another language or that the locale restriction is intentional and justified.

Content

No source excerpt is available for this finding.