ClawHub
Back to skill

Security audit

腾讯云混元文生图像生成

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Tencent Cloud image-generation helper, but users should remember prompts and reference image URLs are sent to Tencent Cloud.

Install this only if you intend to use Tencent Cloud Hunyuan image generation. Use a dedicated least-privilege Tencent Cloud key, keep the .env file private, prefer the virtual environment setup, and do not provide confidential prompts or private/signed reference image URLs unless Tencent Cloud processing is acceptable.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The activation text is broadly worded to trigger whenever a user mentions Tencent/Hunyuan image generation, without clear boundaries such as requiring explicit user confirmation before sending prompts or images to a third-party service. Overbroad routing increases the chance the skill is invoked in situations where the user did not intend external processing of their data.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The instructions say reference image URLs/paths are passed directly to the script, but they do not warn that these references are then sent to Tencent Cloud for processing. This is a material disclosure failure because users may provide private, signed, internal, or otherwise sensitive URLs without realizing they will be exposed to a third party.

Static analysis

No suspicious patterns detected.