ClawHub
Back to skill

Security audit

superx-art-api

Security checks across malware telemetry and agentic risk

Overview

This is a coherent SuperX media-generation API skill, but it can silently use a paid API key and send user prompts or images to a third party without enough user control or warnings.

Install only if you intend to use SuperX for media generation and are comfortable sending prompts, images, and other media references to that service. Confirm before using any stored API key, avoid printing the key, watch for point-consuming requests, and use face-swap only with clear rights and consent from the people depicted.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

High
Confidence
97% confidence
Finding
The skill description is intentionally broad enough to trigger on very common requests like 'draw me a picture' or 'make a video,' which can cause the agent to route many unrelated creative requests into this external integration. That creates unnecessary exposure to third-party API use, potential credential use, and unintended data sharing because the skill may activate even when the user did not explicitly ask to use SuperX.

Missing User Warnings

Medium
Confidence
99% confidence
Finding
The skill explicitly instructs silent use of an API key from the environment, meaning requests to a third-party service may be made without notifying the user that stored credentials are being consumed. In an agent setting, this can lead to unauthorized use of shared secrets, unexpected billing, and covert transmission of user prompts or attached content to an external provider.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The document instructs callers to send API keys plus user prompts and image URLs to an external third-party service, but it provides no privacy notice, retention guidance, or warning that user content leaves the local environment. In an agent skill context, that omission is security-relevant because users may unknowingly submit sensitive text or images to an external processor.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The face-swap endpoint enables processing of facial images without any warning about consent, impersonation risk, or biometric/privacy sensitivity. In a general-purpose agent skill, this materially increases abuse potential because users can be encouraged to upload third-party faces or create deceptive media without safeguards.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.