ClawHub
Back to skill

Security audit

Anygen Diagram Generator Free

Security checks across malware telemetry and agentic risk

Overview

The skill matches its diagram-generation purpose, but it needs review because it sends diagram content to AnyGen, handles API keys, and instructs automatic dependency installation with limited scoping.

Review before installing. Use this only if you are comfortable sending diagram descriptions to AnyGen's service, avoid including secrets or confidential system details, handle API keys outside shared terminals and logs, and manually verify the dependency install target before allowing the agent to run the auto-confirming install command.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly states that user-provided diagram descriptions are sent to the remote service at www.anygen.io for server-side rendering, but it does not clearly warn users about privacy, confidentiality, or data handling implications before transmission. This is dangerous because users may unknowingly submit sensitive architecture, workflow, or internal business information to a third-party service.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The authentication instructions tell users to pass API keys directly on the command line and via environment variables, but do not clearly explain the exposure risks such as shell history, process listing leakage, shared terminal sessions, or accidental logging. This can lead to credential compromise, allowing unauthorized use of the AnyGen account or related service access.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.