ClawHub
Back to skill

Security audit

EdrawMax Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real diagram generator, but it should be reviewed because it sends user prompts to EdrawMax and automatically downloads remote PNG/SVG files with weak download safeguards.

Install only if you are comfortable sending diagram prompts and generated artifacts to EdrawMax-operated remote services. Do not use it for confidential workflows, roadmaps, customer data, or regulated information without approval. Review or harden the downloader before relying on it in sensitive environments, especially redirect handling, exact host allowlisting, file size limits, and PNG/SVG validation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/download_diagram.py:44
Finding

Redirect Destination Bypasses the URL Host Allowlist

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/download_diagram.py:32
Finding

Overbroad Hostname Allowlist Trusts Unrelated Shared-Infrastructure Tenants

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/download_diagram.py:70
Finding

Unbounded and Unvalidated Remote File Downloads

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description centers on diagram generation, but the operational instructions also require downloading remote files and writing them locally, which is a materially different capability from simple content generation. This mismatch can mislead reviewers and users about what the skill will actually do, increasing the risk of unreviewed data egress and disk writes.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill explicitly instructs outbound network use to EdrawMax APIs and later file downloads, but it declares no tool scope or permissions. Missing capability declarations reduce policy visibility and guardrail enforcement, making it easier for a skill to perform external communication without clear operator review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad enough to match generic requests such as 'visualize a process' or 'knowledge map,' which could invoke the skill in contexts the user did not intend. Over-broad invocation increases the chance that user content is sent to an external service without sufficiently specific consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
## Step 2 — Call the API

**Base URL:** `https://api.edrawmax.cn/api/ai`

All four endpoints share the same request format:

External Transmission

Medium
Category
Data Exfiltration
Confidence
77% confidence
Finding

This instruction specifies sending the user's natural-language prompt to an external EdrawMax endpoint. In this skill context that behavior is expected, but it still constitutes real external data transmission and can expose potentially sensitive user content if the user is not clearly informed or if domain restrictions are not enforced by platform policy.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

All four endpoints share the same request format:

text
POST https://api.edrawmax.cn/api/ai/skills/generate-{type}
Content-Type: application/json

{"prompt": "<user description>", "lang": "cn", "platform": "web"}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill says to 'always' download generated files locally and save them to disk, but it does not require notifying the user or obtaining consent for local writes. Silent persistence of files can expose sensitive generated content, surprise users, and create retention/privacy issues on the host system.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill is explicitly designed to send user-supplied prompts to an external domain, which constitutes external transmission of potentially sensitive content. In this context, the danger is elevated because the prompts are likely to include internal processes, roadmaps, timelines, and knowledge structures that users may not realize are being sent to a third-party service.

Content

Scanner excerpt · references/api-reference.md (reported line 9)May include surrounding context.

Base URL

text
https://api.edrawmax.cn/api/ai
  • Auth: None required

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The API reference shows that user prompts are sent to a remote EdrawMax service and that generated outputs are returned as OSS-hosted URLs, but it does not warn users that their input and generated artifacts leave the local environment and may be stored remotely. In a skill that converts arbitrary natural-language descriptions into diagrams, prompts may contain proprietary workflows, project plans, or sensitive business data, so the omission creates a real privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The shared parameters specify lang as optional with a default of "cn", which forces a specific language when the user does not explicitly choose one. This is a language/locale policy concern because the file does not indicate user opt-in or justification for defaulting all requests to Chinese.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.txt (reported line 15)May include surrounding context.

text
1. Ownership
   The Software is owned by and remains the exclusive property of
   Wondershare EdrawMax AI Team（万兴图示 AI 团队）. All intellectual property rights,
   including but not limited to copyrights, patents, trademarks, and
   trade secrets, are reserved by the EdrawMax AI Team.

2. Restrictions

Static analysis

No suspicious patterns detected.