ClawHub
Back to skill

Security audit

AnyGen图表生成器

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AnyGen diagram-generation helper, with normal third-party service and credential-handling risks users should manage carefully.

Install only if you are comfortable using AnyGen's external service for the diagram content you provide. Avoid putting real API keys directly in shell commands, review the dependent skill installation before accepting it, and do not use callback URLs or prompts that expose confidential data unless your organization permits it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The skill explicitly instructs users to pass an API key on the command line (`anygen auth login --api-key ...`), which can expose secrets via shell history, process listings, audit logs, and agent execution traces. This contradicts its own security guidance and creates a realistic credential leakage path in multi-user, logged, or hosted agent environments.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill states that rendering is performed by `www.anygen.io` but does not clearly warn that user-supplied diagram descriptions are transmitted to an external third-party service. Users may unknowingly send proprietary architecture, workflow, API, or business data off-platform, creating confidentiality and compliance risks.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The documented `callback_url` allows outbound network callbacks but provides no warning that results or metadata may be sent to an arbitrary external endpoint. If misused, this can disclose generated content, job status, or internal workflow metadata to attacker-controlled URLs and can increase SSRF-like or data exfiltration risk depending on implementation.

Static analysis

No suspicious patterns detected.