ClawHub
Back to skill

Security audit

An AI-powered tool that turns conversations into polished, structured summary cards by extracting key ideas, action items, and next steps.

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its handling of a Mew.Design API key is too exposed and loosely scoped for automatic approval.

Review this skill before installing if you use a real Mew.Design API key. Only provide a key you are comfortable using through this skill, prefer a limited or revocable key, and be aware that summarized chat content is sent to Mew.Design to generate the image. Do not use it for sensitive conversations unless the key-handling and destination restrictions are fixed.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:130
Finding

Mandatory Third-Party Branding Injected into Generated Images

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/validate_mew_design_key.py:20
Finding

API Key Exposed Through Command-Line Arguments

Content
View full analysis
argparse.Namespace: parser = argparse.ArgumentParser( description="Validate a mew.design API key using an auth-only probe request.", ) parser.add_argument("--api-key", required=True, help="mew.design API key to validate.") parser.add_argument( "--base-url", default=DEFAULT_BASE_URL, help="Gateway base URL.", ) parser.add_argument( "--timeout", type=int, default=30, help="Request timeout in seconds.", ) return parser.parse_args() ``` ### Technical Analysis The Skill directs the agent to interpolate the user's API key directly into a shell command. Command-line arguments can be exposed through process inspection interfaces, task telemetry, audit systems, command logging, debugging output, and shell history. Quoting the value protects command parsing but does not protect its confidentiality. The key is an authentication credential for a billable external API. It should therefore be handled through a secret-specific input channel rather than ordinary command arguments. ### Attack Path 1. The user provides a Mew.Design API key in the conversation. 2. The agent inserts the key into the documented `--api-key` command argument. 3. The validator starts with the plaintext key present in its process argument vector. 4. A local user, monitoring agent, process collector, shell-history reader, or execution-log consumer records or reads the argument. 5. The observer reuses the recovered key against the Mew.Design API. ### Impact Assessment Successful exploitation discl ...[truncated 324 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/validate_mew_design_key.py:21
Finding

Caller-Controlled Validation Endpoint Can Receive the User API Key

Content
View full analysis
argparse.Namespace: parser = argparse.ArgumentParser( description="Validate a mew.design API key using an auth-only probe request.", ) parser.add_argument("--api-key", required=True, help="mew.design API key to validate.") parser.add_argument( "--base-url", default=DEFAULT_BASE_URL, help="Gateway base URL.", ) parser.add_argument( "--timeout", type=int, default=30, help="Request timeout in seconds.", ) return parser.parse_args() def build_endpoint(base_url: str) -> str: normalized = base_url.rstrip("/") + "/" return urllib.parse.urljoin(normalized, "open/api/design/generate") def probe_key(endpoint: str, api_key: str, timeout: int) -> dict: # Send an intentionally invalid body. A valid key should pass auth and fail on payload validation. request = urllib.request.Request( endpoint, data=b"{}", headers={ "Content-Type": "application/json", "x-api-key": api_key, "User-Agent": "curl/8.7.1", "Accept": "*/*", }, method="POST", ) ``` ### Technical Analysis The validator accepts an unrestricted `--base-url`, derives an endpoint from it, and sends the user's API key in the `x-api-key` header. There is no validation of the URL scheme, hostname, port, user-information component, or resolved destination. Although the documented default is `https://api.mew.design/`, a caller can select an arbitrary HTTP or HTTPS server. The script will then disclose the credential to that server. Allowing plaintext HTTP also creates a risk of interception in transit. The endpoint o ...[truncated 1252 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill is presented as a conversation-to-image summarizer, but its behavior includes API-key validation via auth probing and direct external API interaction that are not clearly disclosed by the high-level description. This mismatch can mislead users and reviewers, reducing informed consent and making sensitive key handling and network behavior easier to hide.

Content

No source excerpt is available for this finding.

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/patterns.md (reported line 31)May include surrounding context.

md
## Compression Heuristics

- Merge repeated requests into one clear statement.
- Collapse implementation detail into one bullet unless the detail affects outcome.
- Keep at most one metric per bullet unless comparisons matter.
- Convert long prose into noun-verb phrases.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding

The skill invokes shell commands, writes temporary files, and makes outbound network requests, yet declares no tool scope or permission boundaries. That creates an over-privileged, opaque execution model where an agent may run sensitive actions without explicit installation-time disclosure or policy gating.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The installation trigger phrases are broad and overlap with ordinary user language such as asking for help installing a skill. That increases the chance of accidental activation, causing users to enter a workflow that requests secrets and performs external actions without sufficiently deliberate intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the agent to collect a user's mew.design API key and reuse it, but provides no explicit privacy notice, storage/retention limits, masking guidance, or warning about sending the key to external services. Secret collection without clear handling constraints increases the risk of credential leakage, over-retention, or unsafe display in logs and transcripts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file mandates using the "exact onboarding copy" in Chinese and later provides a Chinese-only style-selection message, with no option to match the user's language. This is a natural-language policy issue because it imposes a specific locale without user choice or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instructions require a fixed Chinese style-selection format after key validation and do not provide an alternative based on user preference. Requiring a specific language for user interaction without opt-in violates the language/locale policy criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The skill transmits user conversation-derived content and the supplied API key to an external service. This is sensitive data egress: private chat content may leave the local environment, and the credential is sent in a request header, so users need clear consent and strict host restrictions before execution.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

Then generate the image through the official Mew design API:

bash
curl -sS -X POST "https://api.mew.design/open/api/design/generate" \
  -H "Content-Type: application/json" \
  -H "x-api-key: USER_PROVIDED_KEY" \
  --data @/tmp/chat-summary-body.json

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The skill transmits user conversation-derived content and the supplied API key to an external service. This is sensitive data egress: private chat content may leave the local environment, and the credential is sent in a request header, so users need clear consent and strict host restrictions before execution.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

Then generate the image through the official Mew design API:

bash
curl -sS -X POST "https://api.mew.design/open/api/design/generate" \
  -H "Content-Type: application/json" \
  -H "x-api-key: USER_PROVIDED_KEY" \
  --data @/tmp/chat-summary-body.json

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction explicitly says to create the image in Chinese unless the provided copy is clearly another language. This imposes a specific language default without offering the user a choice or opt-in, which matches the policy category for language or locale violations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/validate_mew_design_key.py (reported line 13)May include surrounding context.

python
import urllib.parse
import urllib.request

DEFAULT_BASE_URL = "https://api.mew.design/"


def parse_args() -> argparse.Namespace:

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:172