ClawHub
Back to skill

Security audit

ins-style-img-bulk-gen

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed bulk image-generation helper that saves generated images locally, with some selection and clutter cautions but no hidden or destructive behavior found.

Install this only if you want automatic batch generation of INS-style image prompts and local image archiving. Review ambiguous creative requests before letting it run, since the skill defaults to five prompts and saves results to a timestamped folder under ~/Download.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
93% confidence
Finding
The trigger description is overly broad because it allows activation even when the user does not explicitly request Instagram-style output. In an agentic environment, this can cause the wrong skill to be selected for generic image requests, leading to unintended bulk generation, unnecessary parallel tool execution, and writes to the user's filesystem.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill description is broadly phrased to trigger on common creative requests like lifestyle visuals, cover art, or marketing scenes, even when the user does not explicitly request Instagram-style bulk generation. This can cause the agent to invoke a file-writing, multi-step generation workflow in situations where the user intended a narrower or different task, increasing the risk of unexpected actions and resource use.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to save generated images directly into the user's Downloads directory without an explicit disclosure or consent step. Writing files to a user-visible location by default can create privacy, clutter, overwrite, and surprise-execution risks, especially because this skill performs bulk generation and archival automatically.

Static analysis

No suspicious patterns detected.