ClawHub
Back to skill

Security audit

SiliconFlow Qwen Vision

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently performs user-requested image analysis through SiliconFlow, with no hidden persistence or unrelated behavior found.

Install only if you are comfortable sending selected images and prompt text to SiliconFlow for processing. Avoid using it with sensitive, regulated, or confidential images unless you have reviewed the provider's data-handling terms.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README instructs users to use a remote SiliconFlow Qwen2.5-VL service for image analysis but does not explicitly warn that both the image content and user prompts will be transmitted to a third-party remote provider. This can cause inadvertent disclosure of sensitive images, embedded metadata, or confidential prompt content, especially because the skill is specifically designed to process user-supplied images and encourages routine use.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises capabilities that can access environment variables, write files, and use the network, but it does not declare any explicit tool scope or permissions. This creates a transparency and least-privilege problem: a caller may invoke the skill without realizing it can transmit local data and secrets such as API keys to external services or write outputs to disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs users to analyze images via SiliconFlow's Qwen2.5-VL service but does not clearly warn that both the image content and prompts are sent to an external third-party API. This can lead users to unknowingly transmit sensitive images, embedded metadata, or confidential prompts off-device, which is especially risky in a vision-analysis skill where private visual data is the primary input.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file's human-facing descriptions, help text, and default prompt are all hard-coded in Chinese, with no option to select another language or locale. This can violate language/locale policy when a skill imposes a specific language on users without offering choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/analyze_image.py (reported line 33)May include surrounding context.

python
image_data = encode_image(image_path)
    
    # SiliconFlow API 请求
    url = "https://api.siliconflow.cn/v1/chat/completions"
    headers = {
        "Authorization": f"Bearer {api_key}",
        "Content-Type": "application/json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This line performs the actual outbound transmission of the prompt, image data, and API credential-backed request to a remote service. In the context of an image-analysis skill this behavior is expected, but it is still security-relevant because it transfers potentially sensitive content off-host to a third party.

Content

Scanner excerpt · scripts/analyze_image.py (reported line 62)May include surrounding context.

python
"max_tokens": 2048
    }
    
    response = requests.post(url, headers=headers, json=payload, timeout=120)
    
    if response.status_code != 200:
        print(f"Error: API 返回错误 {response.status_code}", file=sys.stderr)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script base64-encodes the user-supplied image and sends it to a third-party API endpoint, but it provides no explicit user-facing warning or consent flow about external data transfer. This is risky because images may contain sensitive personal, confidential, or regulated information, and users may assume local-only analysis from the skill description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The manifest describes a picture-understanding skill for analyzing image content, object recognition, and scene description. While calling a remote vision model is consistent with that purpose, directly sourcing credentials from the process environment introduces a credential-access capability that is not disclosed in the stated skill scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.