ClawHub

Civitai API

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward Civitai API helper, but generated download links can contain the user's API token and should be handled like credentials.

Install only if you are comfortable using a local Civitai API token. Keep CIVITAI_API_KEY out of source control, avoid putting unrelated secrets in the .env file this script may read, and do not share generated download URLs because they may include your token.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs use of environment secrets, local file access via `.env`, and outbound network access to the Civitai API, but the finding indicates these capabilities are not explicitly declared. Undeclared sensitive capabilities reduce transparency and can bypass permission-review expectations, which is risky because the skill also builds authenticated download URLs that may expose tokens if mishandled.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script constructs an authenticated download URL by embedding the API token in the query string and prints that full URL to stdout. Tokens in URLs are prone to accidental disclosure through shell history, logs, terminal capture, process output collection, clipboard sharing, or downstream tooling, which can expose the credential to other users or systems.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal