ClawHub
Back to skill

Security audit

杰哥生图

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill mostly matches its stated purpose, but it needs review because it sends an API key to a default or configurable image gateway and can write files into the project.

Install only if you trust the configured image gateway or will override it with a trusted endpoint. Prefer a dedicated, revocable API key, verify the output path before use, and only pass an auth file that contains credentials intended for this image service.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tainted flow: 'request' from os.environ.get (line 142, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
def request_bytes(request: urllib.request.Request, timeout: int) -> bytes:
    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            return response.read()
    except urllib.error.HTTPError as exc:
        details = exc.read().decode("utf-8", errors="replace")
Confidence
95% confidence
Finding
The code allows a caller-controlled base URL from the OPENAI_BASE_URL environment variable or --base-url argument to influence outbound requests, and those requests include the Bearer API key in the Authorization header. An attacker who can control that setting can redirect traffic to an arbitrary server and exfiltrate the API credential, and image_url values returned by the gateway can also trigger secondary arbitrary downloads.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill instructs the agent to read environment variables, access local files, write generated assets into the project, and make network requests, but it does not declare any explicit tool scope or permission boundaries. This creates an over-privileged execution model where the runtime may allow broader access than users expect, increasing the chance of unintended file modification, secret exposure, or misuse of network capabilities.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The description contains many broad, everyday trigger phrases such as generating, editing, retouching, style transfer, background removal, logos, banners, covers, and general visual material creation, without strong scoping conditions. That makes accidental invocation more likely, which is risky here because the skill can perform network calls and modify project files automatically once triggered.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The workflow explicitly directs the agent to save outputs into the project and integrate them into actual pages or asset references, but it does not prominently warn that this will modify repository files. In context, that is more dangerous because the skill is designed for direct execution rather than draft-only assistance, so a user may trigger persistent changes without informed consent.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The display name, short description, and default prompt are all written only in Chinese, which suggests a fixed language/locale for user interaction. The file does not indicate that users can choose another language or that the Chinese-only behavior is a justified region-specific constraint.

Static analysis

No suspicious patterns detected.