Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this skill suspicious because it reports behavior beyond reference research, privacy and credential handling concerns, and unpinned installation examples; the scan is partial, so the evidence is incomplete.
The verdict is suspicious, not a finding that the author acted maliciously. Consider the reported scope and privacy concerns before installing, avoid sharing confidential images or briefs with external services unless authorized, and review any package or container installation examples before using them. Coverage is marked partial because some referenced paths could not be resolved, so this scan cannot establish that all relevant content was examined.
The command adds an artificial grain-like texture to an image. It does not find, verify, measure, or rank references. This is a content-generation operation, materially distinct from the declared reference-research workflow, which explicitly precedes making content.
The example passes every variable in a generic project '.env' file into a third-party container, potentially exposing unrelated credentials rather than only the Discogs token. This is conditional on the file's contents and execution of the example, but using a mutable image increases the consequence of excessive secret sharing.
cp](https://github.com/cfpramod/open-museum-mcp) | `agent` | `npx -y open-museum-mcp` | Not run. One search over ten museums, strict rights gate: the design to copy |
| [wikimedia-image-search](https://github.com/yanexr/wikimedia-image-search-mcp) | `agent` | `claude mcp add wikimedia-image-search -- npx -y wikimedia-image-search-mcp` | Not run. Raw API first |
| [tmdb](https://github.com/cyanheads/tmdb-mcp-server) | `token` | `claude mcp add tmdb-mcp-server -e TMDB_API_KEY=your-tmdb-read-access-token -- npx -y @cyanheads/tmdb-mcp-server` | Not run. Credits and casting lookups |
| [discogs](https://github.com/cswkim/discogs-mcp-server) | `token` | `docker run --env-file .env discogs-mcp-server:latest` | Not run. The raw API also answered without a token |
| [last.fm](https://github.com/rianvdm/lastfm-mcp) | `token` | `https://lastfm-mcp.com/mcp` | 401 without sign-in |
The keyless hosted servers worked at 2 to 4 stars. They are one person's infrastructure, so name a raw fallback. Skip
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
## Reject if
- You cannot fill the rows this reference is for, or you saw the clip only as a GIF, since re-encoding changes timing.
- You judged it from stills: "Never judge a reference or your own render from one frame every few seconds"
([@finnardley](https://x.com/finnardley/status/2115786060231770351)).
- It is a multi-shot clip offered as the guide for one generated shot.
- A complex camera move and a complex action share the clip ([third-party
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
This never resamples. View it 1:1. `tested 2026-11-03`:
- On a 5063x6657 master scan it returned 512x512 of real detail: single hairs and pores.
- On a 487x640 `r.jpg` it returned 487x512 with no warning. Check the output size: that file is too small for grain.
- The centre may miss what you claim. Aim it with `-auto-orient -crop 512x512+X+Y +repage` and no `-gravity`. Keep
`-auto-orient`: on a phone original (raw 4032x3024, orientation RightTop) an offset crop without it landed on plain
wall (one cold run).
The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
if not binary:
raise ValueError(f"{family} is not on PATH. Log in to its CLI, use the other --family, or loop "
"judge.py prompt through your own subagents, one image per fresh subagent.")
env = {k: v for k, v in os.environ.items() if k not in KEY_VARIABLES}
stop, tally = threading.Event(), collections.Counter()
with concurrent.futures.ThreadPoolExecutor(workers) as pool, open(out_path, "a", encoding="utf-8") as out:
futures = [pool.submit(run_one, t, family, binary, model, env, stop) for t in tasks]
The README says the skill runs locally without clearly distinguishing local processing from external searches and model judging. Request-derived queries or confidential reference material could consequently leave the device without an informed privacy decision; the actual exposure depends on the supplied material and services used.
The command runs an unpinned npm installer and installs skill content from a mutable repository reference. Although this is not an MCP server as the detector claims, compromised upstream releases could execute code or introduce malicious agent instructions with the user's privileges.
The workflow invokes logged-in model CLIs with reference images and brief-derived want cards without an explicit privacy checkpoint. Local CLI execution and the absence of an API key do not mean local inference, so unpublished client assets or creative requirements may be transmitted to model providers.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| Method to borrow | Source |
|---|---|
| "Deal, do not invent": "Asked to invent a look, a model picks the category default every time" | [taste-skill](https://github.com/Leonxlnx/taste-skill/blob/main/skills/taste-skill/SKILL.md) |
| "Text-mediated style transfer is lossy", so read colours and tokens from the reference by script | [tastemaker](https://github.com/codeswithroh/tastemaker/blob/main/skills/tastemaker/SKILL.md) |
| "A prompt that says '1980s' gets a pastiche; one that says 'matte plastic, saturated primaries against beige, chunky rounded shapes, CRT glow' gets the decade" | [layer-art-direction](https://github.com/layerai/skills/blob/main/plugins/layer/skills/layer-art-direction/SKILL.md) |
| Each review is a fresh agent that never sees what was fixed | [critic-loop](https://github.com/NewTurn2017/make-awesome-video/blob/main/references/critic-loop.md) |
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| Method to borrow | Source |
|---|---|
| "Deal, do not invent": "Asked to invent a look, a model picks the category default every time" | [taste-skill](https://github.com/Leonxlnx/taste-skill/blob/main/skills/taste-skill/SKILL.md) |
| "Text-mediated style transfer is lossy", so read colours and tokens from the reference by script | [tastemaker](https://github.com/codeswithroh/tastemaker/blob/main/skills/tastemaker/SKILL.md) |
| "A prompt that says '1980s' gets a pastiche; one that says 'matte plastic, saturated primaries against beige, chunky rounded shapes, CRT glow' gets the decade" | [layer-art-direction](https://github.com/layerai/skills/blob/main/plugins/layer/skills/layer-art-direction/SKILL.md) |
| Each review is a fresh agent that never sees what was fixed | [critic-loop](https://github.com/NewTurn2017/make-awesome-video/blob/main/references/critic-loop.md) |
| "Prompting cannot deliver a grade. Measurement can." One project's claim, not reproduced | [taste-distillation](https
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
nxlnx/taste-skill/blob/main/skills/taste-skill/SKILL.md) |
| "Text-mediated style transfer is lossy", so read colours and tokens from the reference by script | [tastemaker](https://github.com/codeswithroh/tastemaker/blob/main/skills/tastemaker/SKILL.md) |
| "A prompt that says '1980s' gets a pastiche; one that says 'matte plastic, saturated primaries against beige, chunky rounded shapes, CRT glow' gets the decade" | [layer-art-direction](https://github.com/layerai/skills/blob/main/plugins/layer/skills/layer-art-direction/SKILL.md) |
| Each review is a fresh agent that never sees what was fixed | [critic-loop](https://github.com/NewTurn2017/make-awesome-video/blob/main/references/critic-loop.md) |
| "Prompting cannot deliver a grade. Measurement can." One project's claim, not reproduced | [taste-distillation](https://github.com/affaan-m/ecc/blob/main/skills/taste-distillation/SKILL.md) |
| Leave the rest of the Internet Archive out for video: "anyone can upload there, and the licence cl
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
eige, chunky rounded shapes, CRT glow' gets the decade" | [layer-art-direction](https://github.com/layerai/skills/blob/main/plugins/layer/skills/layer-art-direction/SKILL.md) |
| Each review is a fresh agent that never sees what was fixed | [critic-loop](https://github.com/NewTurn2017/make-awesome-video/blob/main/references/critic-loop.md) |
| "Prompting cannot deliver a grade. Measurement can." One project's claim, not reproduced | [taste-distillation](https://github.com/affaan-m/ecc/blob/main/skills/taste-distillation/SKILL.md) |
| Leave the rest of the Internet Archive out for video: "anyone can upload there, and the licence claims are unchecked" | [imagery.md](https://github.com/Leonxlnx/taste-skill/blob/main/skills/taste-skill/references/imagery.md) |
| Closed light vocabulary: Silhouette, Low contrast, Underlight, Edge light, Backlight, Top light, Side light, Soft light, High contrast, Hard light. `tested 2026-11-03`: `test.tsv` parsed, 3,572 rows. Vocabulary only, the frames com
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| Server | Access | Install or endpoint | State, 2026-11-03 |
|---|---|---|---|
| [Refero](https://github.com/referodesign/refero_skill) | `token`, paid for live data | `claude mcp add --transport http refero https://api.refero.design/mcp` | Official, UI only. Not tested |
| [Mobbin](https://github.com/mobbin/mobbin-mcp-server) | `token` | `https://api.mobbin.com/mcp` | Official, UI only. Not tested |
| [Epidemic Sound](https://www.epidemicsound.com/a/mcp-service/mcp) | `token` | `https://www.epidemicsound.com/a/mcp-service/mcp` | Official. 401 without auth |
| [Savee](https://savee.com/mcp) | `token`, paid | | Not tested. Links only |
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| Server | Access | Install or endpoint | State, 2026-11-03 |
|---|---|---|---|
| [Refero](https://github.com/referodesign/refero_skill) | `token`, paid for live data | `claude mcp add --transport http refero https://api.refero.design/mcp` | Official, UI only. Not tested |
| [Mobbin](https://github.com/mobbin/mobbin-mcp-server) | `token` | `https://api.mobbin.com/mcp` | Official, UI only. Not tested |
| [Epidemic Sound](https://www.epidemicsound.com/a/mcp-service/mcp) | `token` | `https://www.epidemicsound.com/a/mcp-service/mcp` | Official. 401 without auth |
| [Savee](https://savee.com/mcp) | `token`, paid | | Not tested. Links only |
| [TheFilmMap](https://thefilmmap.com/mcp) | `agent` | `https://thefilmmap.com/mcp` | Tested. "Which scene was shot where is not recorded and must not be inferred." |
The documented command downloads and executes an unpinned npm package, allowing a compromised or unexpected future release to run with the invoking user's permissions. Its placement in a reference table marked 'Not run' reduces immediate exposure but does not make the installation example reproducible or safe.
The MCP registration command configures execution of an npm package without a fixed version. Although the document prefers the raw API and says this was not run, using the example can execute a later compromised release in the user's environment.
The command registers an unpinned executable package and supplies a TMDB credential to its process. A compromised future package version could therefore access both the token and other resources available to the invoking user; the placeholder itself is not a leaked credential.
The image actually has a ':latest' tag, so the detector's claim that it lacks a tag is inaccurate, but it still lacks an immutable digest. If a changed or compromised image is pulled and run, it receives the environment variables supplied by the command.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
list.
- The registry entry points to a repo that returns 404, or its description is a template:
`<Product> tools for <word>, <word>, <word> by <Publisher>`.
- A search server exposes checkout tools, such as `create_4k_checkout`. Never auto-approve those.
- The same skill appears under clone owners. On skills.sh, `lighting` returned one product-photography skill under six
owners, at 28,905 to 60,459 installs.
The optional setup command executes an unpinned npm package and obtains agent instructions from an unpinned repository. This is an installer supply-chain weakness rather than an unversioned MCP server, and exploitation would require malicious or compromised upstream content.
The prompt asks users to supply real assets and directs automated image judging, including ranking existing references, without checking whether external model processing is authorized. Removing titles and randomizing identifiers does not remove sensitive visual content or confidential requirements from the images and want cards.
Suspicious Unicode normalization or mixed-script content
Suspicious Unicode normalization or mixed-script content
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
| Provenance | Record + person | Named maker and date, a holding archive, or oldest copy before 30 Nov 2022. Unknown fails, except for Never |
| Source allowed | Code | Not on the person-only list (`sources.md`). Person-supplied frames pass |
| Rights | Record + person | `feed` only if yours, licensed for this use, CC0 or public domain, with no identifiable person. Otherwise `words` or `look`. This routes, it does not score |
| Identity safety | Person | Identifiable real people are never fed without consent or a licence. The LLM never names anyone |
| Duplicate | Code | Same image: keep the oldest, with the best provenance |
### 3. Code measures