ClawHub
Back to skill

Security audit

Image and Video Generation with Vydra API

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a documented Vydra API integration, but it asks agents to create accounts, handle billing-related flows, store a paid API key in plaintext, and optionally fetch live mutable instructions without enough consent and storage safeguards.

Review before installing. Use this only if you are comfortable with an agent sending prompts, media URLs, account details, and billing email to Vydra, and spending or initiating paid-credit workflows under your API key. Prefer VYDRA_API_KEY or a secret manager over the documented plaintext credentials file, require explicit human approval for registration and billing actions, and do not treat the live remote skill.md as trusted instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:47
Finding

Plaintext API Key Storage Without Access-Control Requirements

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:47-54
Vulnerability Type: Plaintext credential storage
Risk Level: Medium

Vulnerable Code:

json
Store credentials:
// ~/.config/vydra/credentials.json
{
  "api_key": "vydra_live_xxx",
  "agent_name": "YourAgentName"
}

Technical Analysis

The Skill instructs the agent to persist a bearer API key in a plaintext JSON file under the user's home directory. It does not require restrictive permissions for either the configuration directory or the credential file.

Bearer tokens grant access based solely on possession. Consequently, any local user, process, backup service, diagnostic utility, or unrelated agent capable of reading this file could use the token. This storage is not required for the declared functionality because the Skill metadata already identifies VYDRA_API_KEY as the supported environment variable.

The behavior exceeds minimum privilege by introducing persistent filesystem access to sensitive credentials where an ephemeral environment variable or operating-system secret manager would suffice.

Attack Path

  1. An agent self-registers with Vydra and receives an API key.
  2. Following the Skill instructions, it creates ~/.config/vydra/credentials.json.
  3. The file is created using the process's default permissions, which may permit access by other local principals or services.
  4. An unrelated local process, another user, a backup collector, or a compromised agent reads the file.
  5. The attacker extracts the bearer API key.
  6. The attacker submits authenticated requests to Vydra and consumes the victim's paid credits or accesses account-scoped API functionality.

Impact Assessment

Exploitation grants the attacker the same Vydra API privileges as the exposed key. The likely scope includes generating paid media, checking credit information, and invoking other endpoints authorized for the associated account or organiza ...[truncated 328 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to store the API key in a plaintext JSON file.
  2. Use the already-declared VYDRA_API_KEY environment variable or an operating-system credential manager.
  3. If file-based storage is unavoidable:
    • Create ~/.config/vydra with permission mode 0700.
    • Create credentials.json with permission mode 0600.
    • Reject or repair files with broader permissions before reading them.
    • Avoid following symbolic links when creating or updating the file.
    • Write updates atomically and never use shared temporary directories.
  4. Ensure credentials are excluded from source control, logs, command output, telemetry, crash reports, and backups where feasible.
  5. Document key rotation and revocation procedures.
  6. Use narrowly scoped, revocable tokens if the Vydra service supports them.

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:186
Finding

Unpinned Retrieval of Remotely Mutable Skill Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:186-190
Vulnerability Type: Remote instruction substitution
Risk Level: Medium

Vulnerable Code:

bash
## Live Skill Reference

For the latest API docs, agents can fetch:
curl https://vydra.ai/skill.md

Technical Analysis

The reviewed Skill directs agents to retrieve another Skill document from a live URL. The remote document is mutable and is not constrained by a version, cryptographic hash, signature, or reviewed local copy.

The command does not directly execute downloaded shell code, so this is not confirmed remote code execution. However, if an agent interprets the returned document as authoritative Skill instructions, the remote operator—or an attacker who compromises the hosting infrastructure—can change effective agent behavior after package review. The fetched content could attempt to override local goals, request sensitive information, redirect API requests, or induce unrelated tool operations.

This creates a trust-boundary violation: network-provided text is potentially elevated from untrusted reference material to agent instructions without integrity verification.

Attack Path

  1. An agent loads the audited local Skill.
  2. It follows the “Live Skill Reference” instruction and downloads https://vydra.ai/skill.md.
  3. The remote file has changed since the local package was reviewed, either through an intentional update or compromise of the remote service.
  4. The agent treats the downloaded text as operational instructions rather than untrusted documentation.
  5. Malicious content directs the agent to disclose credentials, use a different endpoint, perform unrelated actions, or weaken existing safeguards.
  6. The agent follows those instructions within the permissions and tools available to its current session.

Impact Assessment

The attainable scope depends on the hosting agent's available tools and permissions. Potential i ...[truncated 477 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction to retrieve a live Skill document during normal operation.
  2. Bundle the reviewed API documentation within the package.
  3. If updates are necessary, retrieve a versioned artifact and verify a pinned cryptographic hash or trusted digital signature.
  4. Explicitly classify all downloaded content as untrusted reference data that cannot override system, developer, user, or local Skill instructions.
  5. Parse only the minimum required API fields instead of exposing the entire remote document to the agent as instructions.
  6. Restrict network destinations to the documented Vydra API origin and require explicit user approval before sending credentials or sensitive content elsewhere.
  7. Subject updated documentation to a new security review before adopting it as executable guidance.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The documentation instructs storing a live API key in a plaintext credentials file under the user’s home directory, which increases the risk of credential theft by other local processes, accidental backup/sync leakage, or inclusion in logs and support bundles. Because the key authorizes paid API usage, compromise can lead to unauthorized spending and abuse of the account.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Store credentials:

json
// ~/.config/vydra/credentials.json
{
  "api_key": "vydra_live_xxx",
  "agent_name": "YourAgentName"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-docs.md (reported line 163)May include surrounding context.

4. Cancel Job

http
DELETE /jobs/{jobId}

Response:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description understates the skill’s capabilities by mentioning image/video generation and self-registration but omitting voice synthesis and billing-related operations. This can mislead users or higher-level agent policy systems about the full scope of data handling and purchasing behavior, increasing the chance of unintended invocation or insufficient review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The phrase that agents can 'self-register and generate images automatically' is overly broad and may encourage autonomous execution of external actions without clear user consent boundaries. In an agent ecosystem, ambiguous scope increases the risk that the skill is invoked to create accounts, consume credits, or transmit data without an explicit approval step.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The self-registration flow instructs agents to transmit a human billing email to an external service and to initiate a billing process, but it does not prominently require informed user consent or warn about sharing personal and billing-related data. This is dangerous because agents may exfiltrate user identifiers or trigger account creation and payment workflows on third-party infrastructure without adequate authorization.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This endpoint sends externally supplied identity data, including agent_name and billing_email, to a third-party service. External transmission is expected for this skill’s purpose, but it is still security-relevant because it can disclose personal data and create external accounts if an agent performs it automatically or on attacker-controlled input.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

Agents can register themselves and request their human add billing:

bash
curl -X POST https://vydra.ai/api/v1/auth/bot-register \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "YourAgentName",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file describes POST endpoints for generating media and includes fields such as prompt, image_url, and video_url, which involve sending user-provided content to the Vydra API. Under the markdown-specific warning rule, the description should disclose privacy or data-handling implications when user data is transmitted to an external system.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The file instructs users to send a bearer API key in requests, which is a sensitive credential, but provides no user-facing warning about secure handling. For markdown documentation, omission of warnings about privacy or system-integrity-relevant behavior can be a quality and safety issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.