ClawHub
Back to skill

Security audit

图像

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly for generating images, but it also broadly triggers on generic automation tasks and can save and send files to Feishu without a clear confirmation boundary.

Review this skill before installing if your agent auto-selects skills. Use it only for image generation tasks where sending the resulting image to Feishu is intended, and require explicit approval for the exact file path and recipient/channel before any send action.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill goes beyond image generation and explicitly instructs saving files locally and sending them via Feishu, which introduces data exfiltration and unintended disclosure risk. Because the messaging behavior is embedded in the workflow and the skill has read/exec/write capabilities, a user may invoke it for a benign image task without realizing it can transfer locally stored content to an external collaboration platform.

Vague Triggers

High
Confidence
86% confidence
Finding
The description uses broad trigger language such as improving efficiency, automation, batch processing, and workflow optimization, which is generic enough to match many unrelated requests. In an agent environment, this increases the chance the skill is auto-selected in contexts where its exec/write/browser-like actions and file-transfer workflow are inappropriate, leading to overbroad execution and accidental sensitive-data handling.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs users to save generated files locally and send them to Feishu, but it does not prominently warn about local persistence, file path exposure, retention, or external data transfer. This can cause users or agents to move content into less controlled locations and transmit it to third-party systems without informed consent, especially if the generated or selected file contains sensitive material.

Static analysis

No suspicious patterns detected.