ClawHub
Back to skill

Security audit

varg-character-cartoon

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill suspicious because scanners flagged guidance that may work around image model refusals, an unpinned installer, and unclear disclosure about sending personal images to an external service.

Before installing, consider whether you are comfortable with the unclear disclosure around external processing of personal images and the unpinned installer. The scan is incomplete: Skillspector left one local path-like reference unresolved, and AIG reported no findings; neither result establishes that the skill is safe.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Recommends replacing blocked franchise names with descriptive wording to obtain the same recognizable output.

Medium
Category
Prompt Injection
Confidence
86% confidence
Finding

The text explicitly connects avoiding IP names to those names being blocked, while directing the agent to preserve the famous, instantly recognizable look through verbal descriptions. This is semantic filter circumvention: the requested result stays the same while the wording changes to avoid the provider's restriction, rather than simply describing an independent artistic style.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The installation example invokes an unpinned npm package through npx, allowing the code executed during installation to change without this document changing. A compromised package release could execute with the user's permissions, although this is an installer supply-chain risk rather than an unpinned MCP server.

Content

No source excerpt is available for this finding.

Local-photo transformation examples omit a warning that images are sent to external services.

Medium
Category
Output Handling
Confidence
91% confidence
Finding

The examples encourage processing local photographs without explicitly explaining that their contents must leave the device for remote generation. Listing the external API and models elsewhere provides some context, but does not clearly establish informed authorization to upload potentially sensitive images.

Content

No source excerpt is available for this finding.

Teaches descriptive substitutions as a workaround for an image model's refusal.

Medium
Category
Prompt Injection
Confidence
87% confidence
Finding

Line 25 explicitly contrasts a refused named-style request with successful generation of the same look through a description. The subsequent recipe and style block operationalize that substitution, making this a deliberate semantic workaround for a downstream restriction rather than merely a neutral discussion of animation styles.

Content

No source excerpt is available for this finding.

The restyling workflow sends a person's photo or character sheet to an external generation service without disclosing that data sharing.

Medium
Category
Output Handling
Confidence
88% confidence
Finding

The workflow directs the agent to pass a person's photo to remote generation through the files input without explicitly requiring disclosure of that transfer. The instruction to obtain consent is a useful mitigation, but does not specify that consent must cover external processing rather than merely use of the person's likeness.

Content

No source excerpt is available for this finding.