ClawHub
Back to skill

Security audit

Anygen Diagram Generator Free

Security checks for vulnerabilities and agentic risk

Overview

This diagram skill is mostly purpose-aligned, but it needs review because it sends content to an external service, installs an unpinned dependency non-interactively, and documents unsafe API-key handling.

Install only if you are comfortable sending diagram text to AnyGen's service. Avoid using it with secrets, private architecture details, regulated data, or customer data unless your organization approves that transfer. Review and pin the dependency before installation, remove automatic -y acceptance where possible, and prefer a secret manager or scoped environment variable over passing API keys on the command line.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:61
Finding

Unpinned Non-Interactive External Skill Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:61-66
Vulnerability Type: Supply-chain risk from an unpinned external dependency
Risk Level: High

Vulnerable Code

bash
anygen skill install --platform claude-code -y

The surrounding instructions state that the external anygen-workflow-generate skill is required, but the installation command does not identify or pin an immutable dependency version, digest, signature, or trusted source. The -y option also suppresses interactive confirmation.

Technical Analysis

The effective behavior of this skill depends on externally resolved content that is not included in the audited project. Consequently, the dependency can change after this audit without any modification to SKILL.md.

An unpinned installation creates a supply-chain trust boundary: compromise of the package registry, installer infrastructure, dependency publisher, or name-resolution process could cause a different or malicious skill to be installed. Non-interactive acceptance increases the likelihood that substituted content will be activated without review.

The documentation also instructs the Agent to install the dependency automatically when it is missing, making this behavior part of the expected execution path rather than an isolated optional example.

Attack Path

  1. An attacker compromises the dependency publisher, registry, distribution infrastructure, or dependency-resolution mechanism.
  2. The attacker publishes or substitutes malicious content under the dependency resolved by the AnyGen installer.
  3. The Agent detects that anygen-workflow-generate is unavailable.
  4. Following SKILL.md, the Agent runs the unpinned installation with -y.
  5. The installer retrieves and activates the attacker-controlled skill without an explicit review step.
  6. The malicious dependency operates with whatever tools and permissions the hosting Agent grants to installed skills, potentially ...[truncated 641 chars]
Remediation
View remediation

Remediation Suggestions

  1. Specify the exact dependency name in every installation command.
  2. Pin the dependency to an immutable version and, where supported, a cryptographic digest.
  3. Retrieve the dependency only from an explicitly configured and trusted registry.
  4. Verify publisher signatures or checksums before activation.
  5. Remove -y and require review of the resolved package name, version, source, and requested permissions.
  6. Document the minimum tool permissions required by the dependency and deny all others.
  7. Maintain an allowlist of approved dependency versions and fail closed if resolution produces a different artifact.
  8. Vendor or include reviewable dependency content in the package when licensing and platform constraints permit.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:47
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:47-51
Vulnerability Type: Sensitive credential exposure through process arguments and execution records
Risk Level: Medium

Vulnerable Code

bash
anygen auth login --api-key sk-your-api-keyxxxxxxxxxxxx

The document recommends replacing the placeholder with an AnyGen API key and passing it directly as a command-line argument. The same authentication pattern is referenced again in the command execution and recovery guidance.

Technical Analysis

Command-line arguments are not a suitable secret-transport mechanism in many operating environments. A real API key supplied this way may be exposed through:

  • Shell command history
  • Agent command transcripts or execution logs
  • Process inspection facilities
  • Terminal recording and debugging systems
  • Monitoring or audit agents that collect process arguments
  • Error reports that reproduce the complete command

Although SKILL.md also mentions environment-variable configuration, it repeatedly presents command-line authentication as an accepted recovery and setup mechanism. Merely using a placeholder in the document does not mitigate the exposure that occurs when a user substitutes a real key.

Attack Path

  1. A user follows the documented authentication instructions and replaces the placeholder with a valid API key.
  2. The shell, Agent, operating system, or monitoring environment records the complete command or exposes its process arguments.
  3. A local user, log reader, support operator, compromised monitoring component, or other party with access to those records retrieves the key.
  4. The attacker submits authenticated requests to AnyGen using the exposed credential.
  5. The credential remains usable until it expires or is revoked.

Impact Assessment

An attacker could obtain the privileges assigned to the exposed API key. Depending on the AnyGen account and key scope, this may include ...[truncated 347 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove examples and recovery instructions that place API keys in command-line arguments.
  2. Prefer an interactive secret prompt that disables terminal echo or accepts the key through standard input.
  3. Where supported, store credentials in the operating system credential manager or a dedicated secret manager.
  4. If environment injection is necessary, use the service-specific ANYGEN_API_KEY variable consistently and scope it to the process rather than persisting it globally.
  5. Ensure Agent execution logs, diagnostic output, and exception messages redact credentials.
  6. Prevent secrets from being written to shell history and configuration files under version control.
  7. Issue narrowly scoped keys with minimal permissions, short lifetimes, and usage limits.
  8. Document immediate revocation and rotation procedures for suspected exposure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The invocation text is overly broad, including use for general data analysis, reporting, statistics, and visualization, even though the skill is specifically for diagram generation through an external service. Overbroad matching can cause the agent to activate this skill in unrelated contexts and unintentionally send user content to external tooling or invoke exec unnecessarily.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill clearly states that user-provided text is sent to www.anygen.io for server-side rendering, but it does not provide a prominent privacy warning, consent requirement, or guidance against sending sensitive content. In an agent context, this is dangerous because users may assume local processing and inadvertently disclose confidential business, architectural, or personal information to a third party.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill claims command execution is restricted to a whitelist, but the documented workflow includes broad exec capability, external CLI installation, and authentication commands without showing any actual enforcement mechanism. This can mislead users or agents into treating arbitrary command execution as safe, increasing the risk of unsafe installs, credential handling, or execution of attacker-influenced commands.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The phrase '已实现以下异常处理与可靠性保障' asserts that empty-input checks, long-input handling, and fallback/default processing already exist. In this skill file, there is no code or concrete procedure demonstrating those protections, so the documentation overstates implemented behavior.

Content

No source excerpt is available for this finding.