Security audit

OraHub Skills

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed OraHub image-editing skill that may install and authenticate a CLI, but its behavior is aligned with editing user-provided photos.

Install only if you intend to use OraHub for photo editing and trust the orahub-cli npm package. Approve global install, device-login, or API-key setup only when you expect your photos or image URLs to be processed through OraHub. VirusTotal telemetry was still pending, so this verdict is based on artifact review and available scanner context.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The router says it must not run runtime or authentication checks at the router level, but the bootstrap section immediately lists commands including `orahub --version` and `orahub auth device-login`. That contradiction can cause an agent to execute installation/auth flows too early, triggering unnecessary privileged actions or interactive login outside the selected leaf workflow's tighter validation and approval path.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list in the skill metadata is broad and includes many generic phrasings such as 'change background' and 'swap background', which can cause the router to invoke this skill for loosely related image-editing requests. In an agent setting, over-broad routing is a real security and safety issue because it can cause unintended command execution paths, unnecessary data handling, or misuse of attached images without sufficiently precise user intent.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation examples are expansive and do not clearly define boundaries against neighboring skills such as generic cleanup, compositing, style transfer, or other reference-based edits. This increases the chance of incorrect skill selection, which is especially risky here because the skill is authorized to invoke an external CLI and process local paths or URLs once routed.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger text is broad and ends with an open-ended 'and similar requests' clause, which can cause the skill to activate for loosely related prompts that were not intended for this workflow. In an agent environment, over-triggering can route user requests to the wrong skill, leading to incorrect execution, unnecessary external CLI/API calls, and unintended handling of user-supplied files or URLs.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The phrase 'make the background look clean' is broad enough to match many unrelated editing requests, such as object removal, blemish cleanup, or full background replacement. That ambiguity can cause incorrect skill selection and unintended processing of user images, which is a real safety and reliability issue in a workflow router.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The phrase 'make the background look clean' is broad enough to match many unrelated editing requests, such as object removal, blemish cleanup, or full background replacement. That ambiguity can cause incorrect skill selection and unintended processing of user images, which is a real safety and reliability issue in a workflow router.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger description uses broad catch-all language such as "and similar requests," which can cause the skill to activate for loosely related prompts instead of only clear background-removal tasks. In an agentic system, overbroad routing can send unintended user content into CLI execution paths, increasing the chance of incorrect tool use, unsafe URL handling, or unexpected file operations.

Static analysis

No suspicious patterns detected.