ClawHub
Back to skill

Security audit

Meitu Beauty

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Meitu portrait-beautification wrapper, but users should understand it uses Meitu credentials and sends portrait images through Meitu's tooling for processing.

Install only if you are comfortable providing Meitu API credentials and having single-person portrait photos processed through Meitu's service. Avoid sensitive facial images unless that external processing and account usage are acceptable in your environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrases include broad language such as '让照片更好看' and generic 'beautify/beauty enhance', which can match ordinary conversation and cause the skill to activate unexpectedly. In this skill's context, unintended activation is more sensitive because it can lead to image processing and transmission to an external service without sufficiently specific user intent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill describes AI beautification but does not clearly warn users that their image may be uploaded or transmitted to Meitu's external service for processing. Because this skill handles personal photos, especially portraits, the omission creates a privacy and consent risk that is more serious than for non-sensitive file types.

Static analysis

No suspicious patterns detected.