ClawHub
Back to skill

Security audit

Train Style Model

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for training a style model, but it tells agents to put potentially private training images in a publicly reachable ZIP without privacy safeguards.

Before installing, only use this skill with datasets you are allowed to send to a third-party image-training service. Prefer a short-lived signed URL or approved private upload path, strip EXIF/location metadata, avoid unreleased or personal images unless explicitly authorized, and delete the archive after ingestion.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:28
Finding

Public Hosting Requirement Exposes Potentially Confidential Training Images

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 28 and 54
Vulnerability Type: Public exposure of sensitive training data
Risk Level: Medium

Vulnerable Instructions

SKILL.md:28:

markdown
2. Curate and zip the dataset (see Technique), host the ZIP at a public URL the platform can fetch, and pass it as `inputs.dataset`.

SKILL.md:54:

markdown
- `inputs.dataset` - a single **ZIP** at a public URL. **10 to 50 images**, a hard bound (below 10 and above 50 both reject). JPEG, PNG, or WebP. Max 50 MB per image (auto-downscaled to 4096px long side, so no pre-resize needed).

Technical Analysis

The Skill explicitly directs the agent to place the training archive at a publicly accessible URL. The dataset may contain proprietary brand artwork, unreleased assets, personal images, or metadata embedded in image files.

The instructions do not require authentication, a short-lived signed URL, restrictive object-storage permissions, metadata removal, deletion after ingestion, or explicit user consent for third-party processing. An unlisted or difficult-to-guess public URL is not an access-control mechanism. Such URLs may be disclosed through application logs, browser history, API request records, referrer data, collaboration channels, or storage enumeration.

The recommendation to register the resulting model as private does not protect the source archive. Model visibility and dataset-object access are separate security boundaries.

Attack Path

  1. A user supplies confidential reference images for model training.
  2. Following the Skill, the agent packages the images into a ZIP archive.
  3. The archive is uploaded to storage with public-read access.
  4. Its URL is submitted to the external training platform and may consequently appear in request logs, execution history, monitoring systems, or shared transcripts.
  5. An unauthorized party obtains or discovers the URL.
  6. The party downloads the archive without authentication a ...[truncated 1054 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the public-hosting requirement with an approved private upload or platform-managed asset-ingestion mechanism.
  2. If URL-based retrieval is unavoidable, use a cryptographically strong, short-lived signed URL restricted to read-only access for the specific object.
  3. Set the URL expiration to the shortest interval sufficient for ingestion and revoke access immediately after the platform confirms retrieval.
  4. Delete the uploaded archive after ingestion and define a documented retention period for any platform-side copies.
  5. Strip EXIF and other unnecessary metadata from all images before packaging.
  6. Obtain explicit user approval before transmitting images to a third-party training service and disclose the recipient, purpose, retention policy, and applicable privacy terms.
  7. Use an unpredictable object identifier, disable directory listing, and ensure storage containers deny anonymous access by default.
  8. Prevent dataset URLs from being written to ordinary logs, analytics, chat transcripts, or error messages. Redact URLs where logging is operationally necessary.
  9. Add a preflight check that rejects sensitive datasets when secure transfer cannot be established.
  10. Clarify that setting importModel.private protects model visibility only and does not secure the source dataset.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep