ClawHub
Back to skill

Security audit

ai-image-gen-free

Security checks for vulnerabilities and agentic risk

Overview

This skill is a basic text-to-image generation guide that uses an API key, network access, command execution, and local image file output in ways that fit its stated purpose, though it is incomplete and should be used with path and key-handling care.

Before installing, confirm you trust the API endpoint and keep the API key in environment variables only. Use explicit, non-sensitive output paths for generated images and check whether a file already exists because the skill does not document overwrite safeguards.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill explicitly instructs writing generated images to disk via user-controllable output paths, but does not clearly warn about overwrite behavior or constrain destinations. In an agent context with read/write/exec capabilities, this can lead to accidental clobbering of existing files or writing into sensitive locations if the output path is unsafe or automatically derived from user input.

Static analysis

No suspicious patterns detected.