ClawHub
Back to skill

Security audit

Ai Image Gen Free

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward image-generation helper that sends prompts to a remote image API and saves generated image files locally, with only minor disclosure and troubleshooting cautions.

Before installing, understand that prompts will be sent to the configured remote image service and generated files will be written to local paths. Do not include secrets or regulated sensitive data in prompts, keep IMAGE_GEN_API_KEY in the environment, and avoid broad network diagnostics unless you explicitly want troubleshooting performed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Low
Confidence
84% confidence
Finding
The skill instructs the agent to run ping/network diagnostics during error handling even though that behavior is outside the skill's core image-generation scope. In agent environments with exec access, this expands operational behavior into arbitrary network probing, which can expose internal network information, enable unintended reconnaissance, or violate least-privilege expectations.

Missing User Warnings

Low
Confidence
78% confidence
Finding
The skill describes sending prompts to an external API and writing generated images to local files, but it does not prominently warn users about those side effects before execution. In an agent context, lack of disclosure can cause sensitive prompts or regulated data to be transmitted off-box and files to be created unexpectedly, undermining informed consent and safe data handling.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.