ClawHub
Back to skill

Security audit

Train Style Model

Security checks across malware telemetry and agentic risk

Overview

This skill coherently guides an agent through training a custom image style model, with the main user risk being careful handling of the training image ZIP before upload.

Before using this skill, make sure the ZIP contains only images you are allowed to upload for model training. Prefer a private, time-limited, least-privilege URL if the platform accepts it, keep the trained model private while testing, and version retrains so you can roll back.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly instructs the operator to host the ZIP training dataset at a public URL the platform can fetch, but it provides no warning that the dataset may contain sensitive, proprietary, or personal images. In this context, training data is likely to include brand assets, internal creative material, or likenesses, so directing public exposure without privacy guidance creates a real risk of unintended data disclosure.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.