Turn a real photo into a custom anime-style avatar, Moments cover, or Twitter/X header.

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:43 AM UTC
• Version: 1.0.4

Overview

This skill is a disclosed photo-to-anime generator that uses a user-provided mew.design API key and uploaded photo for its stated purpose.

Before installing, understand that using this skill means giving the agent a mew.design API key and an uploaded personal photo so it can send them to mew.design for image processing. Confirm the exact ClawHub skill package before installation and avoid sharing photos or credentials you do not want processed by that third-party service.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The installation trigger examples are broad enough that a generic request like 'help me install this skill' could cause the agent to initiate installation without strong confirmation of the exact package or source. In an ecosystem where skills can access data or invoke external services, ambiguous install triggers increase the risk of unintended or socially engineered skill installation.

External Transmission

Medium

• Category: Data Exfiltration

Content

- Moments cover images based on a user's photo and outfit vibe
- Twitter/X header images based on a user's photo and outfit vibe

Do not use `design/generate` for this skill. Use only the official Mew endpoint `POST https://api.mew.design/open/api/image/process`.

## Required flow

• Confidence: 92% confidence
• Finding: This skill instructs the agent to send user photos and a user-provided API key to an external third-party service. Even though external processing is core to the feature, transmitting biometric-like personal images to an external endpoint creates meaningful privacy and data-handling risk, especially if users are not clearly warned and consent is not explicitly obtained at send time.

External Transmission

Medium

• Category: Data Exfiltration

Content

Endpoint:

```text
POST https://api.mew.design/open/api/image/process
```

Auth:

• Confidence: 95% confidence
• Finding: The API section operationalizes repeated transmission of sensitive user inputs to an external endpoint via authenticated requests. Because the skill depends on sending source images and credentials off-platform, the danger is elevated by the combination of personal photo data, third-party processing, and the possibility that users may not fully understand the disclosure boundary.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The instruction "Respond in Chinese" imposes a fixed language choice for all interactions. This is a natural-language policy concern because it forces a locale/language behavior without offering the user a choice or documenting a justified region-specific constraint.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: This file presents section headings in Chinese with English translations while the usage instruction is in English, effectively imposing mixed-language content on users without any opt-in or stated locale scope. Under the policy, forcing a specific language or locale without user choice can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.