ClawHub
Back to skill

Security audit

Anygen Diagram

Security checks for vulnerabilities and agentic risk

Overview

This skill is a markdown-only guide for generating diagrams with AnyGen, and its command, file, API-key, and external API behaviors are disclosed and aligned with that purpose.

Install only if you intend to use AnyGen's external service and are comfortable sending diagram descriptions or source document excerpts to that service. Use scoped API keys, keep outputs in project-specific folders, review any generated command before running it, and redact sensitive business or architecture details when policy requires it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The examples encourage command execution, filesystem writes, and outbound API use without prominent warnings about side effects, sensitive data transmission, overwrite risks, or confirmation requirements. In an agent setting, that can lead to unreviewed local changes or unintended exfiltration of document contents to a third-party service.

External Transmission

Medium
Category
Data Exfiltration
Content
--output ./diagrams/user_flow.svg
# ...
# API 集成到文档系统
curl -X POST https://api.anygen.io/v1/diagrams \
  -H "Authorization: Bearer $ANYGEN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
96% confidence
Finding
The documented curl example sends user-provided content to an external endpoint using an API key, creating a real data egress path. In this skill context, users may provide PRD or architecture data that can be sensitive, and the documentation does not require consent, minimization, or sanitization before transmission.

External Transmission

Medium
Category
Data Exfiltration
Content
--output ./diagrams/user_flow.svg
# ...
# API 集成到文档系统
curl -X POST https://api.anygen.io/v1/diagrams \
  -H "Authorization: Bearer $ANYGEN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
96% confidence
Finding
The documented curl example sends user-provided content to an external endpoint using an API key, creating a real data egress path. In this skill context, users may provide PRD or architecture data that can be sensitive, and the documentation does not require consent, minimization, or sanitization before transmission.

Static analysis

No suspicious patterns detected.