ClawHub
Back to skill

Security audit

Anygen Diagram

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AnyGen diagram-generation workflow that uses expected CLI/API calls and an API key, with no hidden persistence or unrelated behavior found.

Install only if you intend to use AnyGen Pro and are comfortable sending diagram descriptions, PRD extracts, and generated assets to AnyGen or configured team repositories. Use a secret manager or short-lived session handling for ANYGEN_API_KEY, and avoid running the examples on confidential documents unless your organization approves that data flow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The skill includes examples that export an API key into the shell environment and send authenticated requests to an external service without an explicit warning about credential handling or data exposure. In an agent/exec context, users may copy these commands directly, risking accidental disclosure of secrets in shell history, logs, screenshots, or transmission of sensitive document content to a third-party API.

External Transmission

Medium
Category
Data Exfiltration
Content
--output ./diagrams/user_flow.svg

# API 集成到文档系统
curl -X POST https://api.anygen.io/v1/diagrams \
  -H "Authorization: Bearer $ANYGEN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
88% confidence
Finding
curl -X POST https://api.anygen.io/v1/diagrams \ -H "Authorization: Bearer $ANYGEN_API_KEY" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
--output ./diagrams/user_flow.svg

# API 集成到文档系统
curl -X POST https://api.anygen.io/v1/diagrams \
  -H "Authorization: Bearer $ANYGEN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
88% confidence
Finding
https://api.anygen.io/

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.