ClawHub
Back to skill

Security audit

pruna-api

Security checks across malware telemetry and agentic risk

Overview

This skill is a documentation-only helper for Pruna and Replicate API use, with disclosed remote uploads, credential handling, paid-call checks, and user confirmation requirements.

Before installing, understand that using this skill for generation can send selected images, audio, portraits, scripts, or other media to Pruna or Replicate and can incur paid API calls. Only use it with files you intend to upload, keep API keys in environment variables, and confirm output paths before downloads.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Content
## File uploads

Local files leave the machine and are processed at `https://api.pruna.ai/` — see [agent-safety.md](./agent-safety.md).

1. `POST /v1/files` with `-F "content=@/path/to/file.jpg"` and `apikey` header.
2. Use `urls.get` from the response (or construct `https://api.pruna.ai/v1/files/{id}`) as the **`image`**, **`last_frame_image`**, **`images[]`**, **`person_image`**, **`garment_images[]`**, **`audio`**, etc. value in `input`.
Confidence
83% confidence
Finding
https://api.pruna.ai/

External Transmission

Medium
Category
Data Exfiltration
Content
Local files leave the machine and are processed at `https://api.pruna.ai/` — see [agent-safety.md](./agent-safety.md).

1. `POST /v1/files` with `-F "content=@/path/to/file.jpg"` and `apikey` header.
2. Use `urls.get` from the response (or construct `https://api.pruna.ai/v1/files/{id}`) as the **`image`**, **`last_frame_image`**, **`images[]`**, **`person_image`**, **`garment_images[]`**, **`audio`**, etc. value in `input`.

Uploaded files expire (see upload response `expires_at`).
Confidence
86% confidence
Finding
https://api.pruna.ai/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.