ClawHub
Back to skill

Security audit

the ai painting interface of suichuang api

Security checks across malware telemetry and agentic risk

Overview

This is a simple image-generation skill that uses a user-provided API key with a third-party image API and has no bundled code, persistence, or hidden local access.

Install only if you intend to use the api.wuyinkeji.com image service. Use a dedicated API key, avoid sensitive or private prompt content, and be aware that prompts may be translated to English and that the key is included in API requests and polling URLs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly instructs sending user-supplied prompts to a third-party image-generation API, but it provides no user notice, consent step, data handling disclosure, or privacy warning. This is dangerous because prompts may contain personal, confidential, or regulated information, and the skill normalizes external disclosure without transparency.

Natural-Language Policy Violations

Medium
Confidence
77% confidence
Finding
The skill mandates translating prompts into English before submission without informing the user or offering opt-in. This can alter meaning, introduce unintended disclosure through transformation, and reduce user control over what is actually sent to the third-party service.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.