ClawHub
Back to skill

Security audit

Google vertex image generator

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a disclosed Vertex AI image helper, but its script contains an under-scoped URL download path that could forward a Google OAuth token to an untrusted URL if reached.

Review this carefully before installing. It needs Google Cloud credentials and can read prompts and write outputs locally, which is expected, but the URL fallback should be fixed or removed so tokens are only sent to trusted Google Vertex AI endpoints. The script also appears broken as shipped due to an undefined request URL.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
cmd = ['curl', '-sS', '-L', uri, '-o', out_path]
    if token:
        cmd[1:1] = ['-H', f'Authorization: Bearer {token}']
    proc = subprocess.run(cmd, capture_output=True)
    return proc.returncode == 0
Confidence
92% confidence
Finding
proc = subprocess.run(cmd, capture_output=True)

Tp4

High
Category
MCP Tool Poisoning
Confidence
82% confidence
Finding
The skill description narrows expectations to ADC-based Vertex AI image generation, but the documented behavior is broader: it supports user-token auth and may download arbitrary image URLs returned by a response. That mismatch is dangerous because users may grant trust and permissions assuming a constrained cloud API call, while the implementation can perform additional network-retrieval behavior and alternate authentication flows that expand the attack surface and data-handling risk.

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The code recursively finds any URI in the response and downloads the first match, extending behavior from image generation into arbitrary network retrieval. If a response is malicious or compromised, the script can be induced to contact attacker-controlled servers or internal resources, and because it attaches the Bearer token, this can expose cloud credentials.

Unvalidated Output Injection

High
Category
Output Handling
Content
cmd = ['curl', '-sS', '-L', uri, '-o', out_path]
    if token:
        cmd[1:1] = ['-H', f'Authorization: Bearer {token}']
    proc = subprocess.run(cmd, capture_output=True)
    return proc.returncode == 0
Confidence
90% confidence
Finding
subprocess.run(cmd, capture_output

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.