ClawHub

removebg-api

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says: it removes backgrounds by sending a chosen workspace image to remove.bg and saving the result locally.

Install this only if you are comfortable sending selected images to remove.bg and using your remove.bg account quota. Keep REMOVE_BG_API_KEY in OpenClaw-managed secret configuration and avoid using the skill for sensitive images unless remove.bg's terms are acceptable to you.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill documentation and metadata indicate use of an API key, local file input/output, and a third-party network call, but no explicit permissions are declared to match those capabilities. This creates a policy and review gap: a host may allow the skill to access sensitive environment variables, read workspace files, write outputs, and transmit data externally without users or enforcement layers having a clear permission declaration to validate against.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script sends the user's image bytes to the third-party remove.bg service, but the runtime behavior provides no explicit user-facing disclosure or confirmation before transmission. In an agent/skill context, users may assume local processing, so silent cloud upload can expose sensitive image contents and metadata to an external processor unexpectedly.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal