ClawHub
Back to skill

Security audit

Ernie Image Art Name

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it sends chosen text to Baidu ERNIE-Image to create local art images, with an optional plaintext token config users should handle carefully.

Install only if you are comfortable sending the generated name/text and prompt details to Baidu's ERNIE-Image service. Prefer using an environment variable or one-time --token instead of --set-token on shared, backed-up, or source-controlled machines, because --set-token writes the access token to plaintext config.json in the skill directory.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
79% confidence
Finding
The trigger phrases are very broad and overlap with ordinary requests about text design or image generation, so the skill may activate in contexts where users did not intend to use an external Baidu-backed workflow. Overbroad activation increases the chance of inadvertent data transmission or local file creation without sufficiently informed user intent.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The description explains functionality but does not clearly warn that user-provided text and access credentials may be used with an external Baidu API and that outputs are saved to local storage. This weakens informed consent and can expose personal names, text content, and operational secrets to third-party services or local disk unintentionally.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs users to store the Access Token in config.json without warning that this places credentials on disk, where they may be read by other local users, backups, logs, or accidental commits. Storing long-lived tokens in plaintext materially increases the risk of credential theft and unauthorized API use.

Missing User Warnings

Medium
Confidence
79% confidence
Finding
The script persists the access token to config.json without warning about local secret storage risks or setting restrictive file permissions. On multi-user systems or in shared workspaces, another user or process could read the token and reuse it to access the external API.

Static analysis

No suspicious patterns detected.