ClawHub
Back to skill

Security audit

Clawf Selfie

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says, but it can generate and send images to messaging channels from broad casual prompts without a clear confirmation step.

Review before installing. Use this only if you are comfortable with character reference images, prompts, generated image URLs, and an API key being sent to a remote image service, and with generated images being posted to messaging channels. Prefer adding an explicit confirmation or preview step before sending, and restrict CRS_API_URL to a trusted endpoint.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

High
Confidence
94% confidence
Finding
The trigger phrases are broad enough to match ordinary conversation such as 'how are you doing?' or 'where are you?', which can activate the skill without clear user intent to generate and transmit an image. In this skill's context, unintended activation is more dangerous because it sends character-derived content to an external image generation service and then posts the result to messaging channels automatically.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill description does not clearly warn that it reads `reference_image_url` from `character.json`, sends that reference to a third-party service, and posts generated images to external messaging platforms. This lack of transparency undermines informed consent and can expose sensitive character-associated data or generated content to external systems unexpectedly.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The script sends the secret CRS_API_KEY_ID to an external third-party service as part of the JSON body. While this may be functionally required for the integration, the user-facing behavior does not clearly warn that a credential and prompt data will be transmitted off-host, which creates a real secret-handling and transparency risk if users assume the skill is local-only or trusted by default.

External Transmission

Medium
Category
Data Exfiltration
Content
# Call aibotclaw API (can take up to 60s, set timeout to 70s)
API_URL="${CRS_API_URL:-https://aibotclaw.com/api/external/image/generate}"
RESPONSE=$(curl -s -X POST "$API_URL" \
    -H "Content-Type: application/json" \
    --max-time 70 \
    -d "$JSON_PAYLOAD")
Confidence
94% confidence
Finding
curl -s -X POST "$API_URL" \ -H "Content-Type: application/json" \ --max-time 70 \ -d

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.