ClawHub
Back to skill

Security audit

Anygen Diagram Generator

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed diagram-generation integration that sends diagram descriptions to AnyGen's server and uses AnyGen authentication, with privacy and credential-handling caveats users should understand.

Install only if you are comfortable sending diagram prompts and generated diagram content to AnyGen's service. Avoid including secrets, regulated data, or sensitive proprietary architecture unless approved, and prefer a managed environment variable or browser login over pasting real API keys into chats, scripts, or logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly directs agents to send user-provided natural-language content to `www.anygen.io` for server-side rendering, but it does not present a prominent user-facing warning that their input will leave the local environment. This can cause inadvertent transmission of sensitive architecture, API, business-process, or design data to a third-party service without informed user consent.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The authentication section instructs users to pass API keys directly on the command line and via environment variables, but lacks strong warnings about shell history, process-list exposure, logging, and accidental disclosure in transcripts or version-controlled files. In an agent-execution context, these credentials may also be echoed, captured, or reused unintentionally, increasing the risk of credential leakage.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.