ClawHub
Back to skill

Security audit

TS Images

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small, disclosed image-generation API wrapper that sends user-provided JSON to configured image service endpoints using a configured token.

Install only if you trust the source that provides TS_TOKEN and AIZNT_PROXY_URLS. Treat prompts, request bodies, and any --body-file data as information intentionally sent to the configured image-generation service.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares required environment variables and clearly relies on outbound API calls, but it does not declare explicit permissions for env and network access. Missing permission declarations weaken review and enforcement boundaries, making it easier for a skill to access secrets or external endpoints without transparent authorization metadata.

Static analysis

No suspicious patterns detected.