ClawHub
Back to skill

Security audit

Jimeng AI

Security checks for vulnerabilities and agentic risk

Overview

The available evidence shows a Jimeng AI connector skill with broad routing language, but no artifact-backed sign of hidden, destructive, or exfiltrating behavior.

Install only if you intend the agent to use this skill for Jimeng AI tasks. Treat generation, account-changing, or paid API actions as actions that should require clear user intent and confirmation. VirusTotal was clean, and the advisory scanner did not identify malicious behavior.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The invocation description is extremely broad: it directs the agent to use this skill for ANY Jimeng AI request and instead of calling the API directly. Overbroad routing can cause the skill to be selected in more situations than necessary, increasing the chance of unintended writes, unnecessary connector access, or bypass of safer/more specific handling paths.

Static analysis

No suspicious patterns detected.