ClawHub
Back to skill

Security audit

AI Girl & Character Generator

Security checks for vulnerabilities and agentic risk

Overview

This instruction-only skill is consistent with its Media.io image-generation purpose, though users should understand it sends prompts and image URLs to Media.io and may use account credits.

Install only if you intend to let the agent call Media.io using your API key. Use user-owned or authorized image URLs, avoid private/internal images unless they are safe to share with Media.io, and monitor Media.io credit usage.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill relies on a user-supplied image URL being sent to Media.io and explicitly requires that the URL be reachable by Media.io servers, but the usage guidance does not clearly warn users that their image URL and referenced content will be transmitted to a third-party service. This creates a real privacy and data-handling risk because users may unknowingly provide sensitive or private URLs under the assumption processing is local or first-party only.

Static analysis

No suspicious patterns detected.