ClawHub
Back to skill

Security audit

Openai Image Gen

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a straightforward OpenAI image-generation helper that uses an API key, sends prompts to OpenAI, and saves generated images locally.

Before installing, make sure you are comfortable providing an OPENAI_API_KEY, sending image prompts to OpenAI, and storing generated images in the configured local output directory. Do not include secrets, private personal data, or confidential business material in prompts unless that use is approved for your environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill requires access to an API key in the environment and makes outbound network calls, but the manifest does not declare these capabilities or warn the user. That creates a transparency and consent problem: users may run a skill that sends data externally and consumes a secret without the permission surface being clearly documented.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation describes generation behavior and output files, but it does not clearly warn that prompts and resulting images are transmitted to a third-party API and persisted to local disk. This can lead users to unintentionally disclose sensitive prompt content or store sensitive generated material in locations they did not expect.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.