ClawHub
Back to skill

Security audit

seedream 5.0 lite

Security checks across malware telemetry and agentic risk

Overview

This is a coherent image-generation skill that calls redfox.hk with user-provided prompts or images, with no evidence of hidden, destructive, or unrelated behavior.

Install only if you are comfortable using redfox.hk for image generation. Treat prompts, uploaded reference images, and generated image URLs as data sent to a third-party service, and use a revocable REDFOX_API_KEY rather than placing secrets in prompts or shared files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The README's invocation examples are very broad natural-language phrases for common image-generation tasks, without clear boundaries for when this skill should or should not activate. In an agent environment, that can cause over-triggering on generic user requests, leading to unintended use of this skill, unnecessary external API calls, and possible transfer of user prompts or images to a third-party service without sufficiently explicit user intent.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The invocation description is broad and tied to common activities like image generation and prompt optimization, without clear trigger boundaries. In an agent ecosystem, this can cause over-invocation, leading the tool to receive unrelated user content, reference images, or sensitive prompts that are then sent to a third-party service.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation promotes uploading prompts, local reference images, and downloading generated image URLs, but does not clearly warn that this content is transmitted to redfox.hk and may be stored remotely, including OSS-hosted URLs. Users may unknowingly expose sensitive text, personal photos, or confidential assets to third-party systems.

VirusTotal

54/54 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.