ClawHub
Back to skill

Security audit

Multimedia Manager

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent local media gallery, but users should review it because its gallery can run without authentication if no token is configured and it stores sensitive photo metadata such as GPS coordinates.

Install only if you are comfortable with a local gallery that indexes private media and may store precise photo locations. Run setup so a token is generated, keep .env and terminal output private, do not bind IMAGE_VAULT_HOST to a public interface without hardening authentication, and use the cleanup script carefully because its actual deletion threshold is in hours.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Intent-Code Divergence

Medium
Confidence
89% confidence
Finding
The script generates an access token and writes it to .env, but also echoes the token directly to the terminal. Console output may be captured in shell history tools, terminal scrollback, session logs, CI logs, or screen recordings, which unnecessarily exposes a credential intended to protect access to the gallery.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The importer automatically extracts GPS coordinates from EXIF and persists them, and may also enrich location fields from AI output, without any consent gate, warning, or minimization. In a media-vault context this increases privacy risk substantially because sensitive home, workplace, or travel-location data can be silently retained and later exposed through the database, logs, backups, or downstream features.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
Printing a newly generated access token to the console exposes a secret outside its intended storage location. Anyone with access to terminal logs, remote shell transcripts, or shared workstation sessions could recover the token and use it to authenticate to the local gallery service.

Credential Access

High
Category
Privilege Escalation
Content
IMAGE_VAULT_TOKEN=$TOKEN
# IMAGE_VAULT_DIR=$DEFAULT_VAULT
EOF
  echo "✓ Created .env with auto-generated token: $TOKEN"
  echo "  ⚠ Save this token — you'll need it to access the gallery"
else
  echo "✓ .env already exists"
Confidence
93% confidence
Finding
This finding corresponds to handling a real credential, and the surrounding code immediately prints that credential to the console after writing it to .env. While the token is locally generated for legitimate use, exposing it in output creates an avoidable credential disclosure risk.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Multimedia Manager (Community Edition)
Flask>=3.0
Pillow>=10.0
PyYAML>=6.0
Confidence
98% confidence
Finding
The dependency specification uses a lower-bound only constraint (Flask>=3.0), which makes builds non-reproducible and allows future vulnerable or breaking releases to be installed without review. In a server-side web application context, dependency drift can directly expose the application to newly introduced security issues in Flask or its transitive dependencies.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Multimedia Manager (Community Edition)
Flask>=3.0
Pillow>=10.0
PyYAML>=6.0
Confidence
99% confidence
Finding
Pillow>=10.0 is unpinned, so deployments may silently consume later releases, including ones with image parsing flaws or unsafe behavior changes. Because Pillow processes untrusted multimedia content in a 'Multimedia Manager' skill, uncontrolled upgrades are especially risky and can increase exposure to denial-of-service or code-execution bugs in image decoders.

Unpinned Dependencies

Low
Category
Supply Chain
Content
# Multimedia Manager (Community Edition)
Flask>=3.0
Pillow>=10.0
PyYAML>=6.0
Confidence
99% confidence
Finding
PyYAML>=6.0 allows any later version to be installed, which weakens supply-chain control and can pull in vulnerable or behavior-changing releases. If this skill parses YAML from users, configs, or imported media metadata, dependency drift in PyYAML can materially affect deserialization safety.

Static analysis

No suspicious patterns detected.