ClawHub
Back to skill

Security audit

xAI Image Generator

Security checks across malware telemetry and agentic risk

Overview

This appears to be a straightforward xAI image-generation helper, with the main risks being expected third-party API use, prompt sharing, and API-key handling.

Install only if you are comfortable sending image prompts and generation parameters to xAI and using an xAI API key. Avoid putting secrets, personal data, or confidential business information in prompts, prefer a scoped API key, store it in a secrets manager or temporary environment when possible, and review or pin dependencies before production use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (6)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The deployment notes describe the external image-generation API, bearer-token authentication, and internet requirement, but they do not clearly warn users that prompts and credentials will be transmitted off-host to a third-party service. This can cause users to unknowingly send sensitive prompts or operate the skill in environments where external data transfer is restricted, increasing privacy and compliance risk.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill clearly sends user prompts to xAI's remote image-generation service, but the documentation does not prominently warn users that prompt content and related request metadata leave the local environment. This creates a real privacy and data-handling risk because users may unknowingly submit sensitive information to a third-party API.

External Transmission

Medium
Category
Data Exfiltration
Content
## API Details

- Endpoint: https://api.x.ai/v1/images/generations
- Model: grok-imagine-image
- Authentication: Bearer token (XAI_API_KEY)
- Output: JPEG images via URL or base64
Confidence
82% confidence
Finding
https://api.x.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
## API Details

- **Endpoint:** `https://api.x.ai/v1/images/generations`
- **Model:** `grok-imagine-image`
- **Authentication:** Bearer token via `XAI_API_KEY`
- **Rate Limits:** Subject to xAI API limits (check xAI docs)
Confidence
90% confidence
Finding
https://api.x.ai/

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
Confidence
96% confidence
Finding
requests>=2.28.0

Known Vulnerable Dependency: requests==2.28.0 — 7 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +4 more

High
Category
Supply Chain
Confidence
84% confidence
Finding
requests==2.28.0

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.