ClawHub
Back to skill

Security audit

GPT Image Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned image automation, but it gives the agent broad control of a logged-in daily Brave browser and includes unsafe prompt-insertion instructions.

Review before installing. Use this only if you are comfortable letting the agent control an already-logged-in Brave session through remote debugging. Prefer a dedicated browser profile or isolated automation browser, avoid untrusted prompt text until prompt encoding is fixed, and confirm any Feishu destination before sending generated media.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:82
Finding

Unsafe User-Prompt Interpolation Enables Shell and JavaScript Injection

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:4
Finding

Full CDP Control of the User's Daily Browser Violates Least Privilege

Content
View full analysis
str: """Evaluate JS via CDP using the shared brave-browser-agent cdp_exec.py.""" brave_dir = os.path.expanduser("brave-browser-agent/scripts") cdp_script = os.path.join(brave_dir, "cdp_exec.py") cmd = [sys.executable, cdp_script, "--port", str(port), "eval", tab_id, expr] if await_promise: cmd.append("--await-promise") r = subprocess.run(cmd, capture_output=True, text=True, timeout=60) ``` ### Technical Analysis Chrome DevTools Pr ...[truncated 2629 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill does not prominently warn that it will attach to and operate the user's already logged-in daily Brave session shared with another skill. That omission is dangerous because the browser context may contain sensitive authenticated data, cookies, open tabs, and cross-site state beyond chatgpt.com, so the user may not realize they are granting control over a live personal session.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill performs shell execution, browser automation, and local network access to a shared browser debug port, but it declares no explicit tool scope or permission boundaries. This creates a capability/consent gap: an orchestrator or user may invoke the skill without understanding that it can control a logged-in browser session and run local commands.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The invocation criteria are broad enough to catch generic image-related requests, increasing the chance this skill is selected when a safer or less-privileged image workflow would suffice. Because the skill drives a logged-in shared browser session, over-selection materially increases unnecessary exposure to authenticated web state and browser-side side effects.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
# 通过 CDP 创建新标签页
import json, urllib.request, asyncio, websockets

info = json.loads(urllib.request.urlopen("http://localhost:9222/json/version").read())
ws_url = info.get("webSocketDebuggerUrl")

async def create_tab():

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract_image.py (reported line 34)May include surrounding context.

python
"eval", tab_id, expr]
    if await_promise:
        cmd.append("--await-promise")
    r = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
    if r.returncode != 0:
        raise RuntimeError(f"cdp_exec failed: {r.stderr.strip() or r.stdout.strip()}")
    return r.stdout.strip()