ClawHub
Back to skill

Security audit

Yufluent Clawhub Publish Yufluentcn Ecommerce Imaging

Security checks across malware telemetry and agentic risk

Overview

This appears to be a cloud-backed e-commerce image generator with disclosed API-key and image-upload behavior, and no evidence of hidden, destructive, or unrelated data-stealing actions.

Install only if you are comfortable sending product prompts, source images, and the Yufluent API key to the configured service. Avoid uploading confidential unreleased product photos unless approved, and consider stripping image metadata before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
When /skills/*/run returns certain server errors, the client silently falls back to a generic /agent/turn orchestration path instead of staying confined to the declared ecommerce-imaging function. That broader path can change execution semantics and may invoke assistant capabilities beyond the user's expected image-generation-only scope, increasing the chance of unintended actions or data handling.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The fallback request body explicitly enables web-assisted execution via web_fast=True while framing the request as 'directly execute skill' through the generic agent endpoint. For a skill advertised as cloud ecommerce image generation, enabling broader web-capable agent behavior expands the operational scope and could cause unexpected external lookups or behavior outside the stated purpose.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README instructs users to send product prompts and source images to a cloud-backed image generation service, but it does not clearly warn that uploaded images and associated metadata will leave the local environment and be transmitted to external infrastructure. In an ecommerce context, source images may contain unreleased products, branding, packaging, EXIF metadata, or other commercially sensitive content, so the lack of disclosure can lead to inadvertent data exposure and compliance issues.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.