ClawHub
Back to skill

Security audit

AI 海报生成与编辑｜商业美术与版式系统

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI poster-generation helper that uploads user-specified images to a named AI Hive API and saves generated outputs locally.

Before installing, use it only with assets you are authorized to upload to AI Hive, and treat the saved API key as a credential. Review any presigned upload/download destination if your environment requires strict host allowlisting.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs users to run local Python commands that can read files, write files, access environment variables, invoke the shell, and send data to a remote API, yet it declares no permissions or capability boundaries. Even though the content says only specified authorized assets are uploaded and names a fixed endpoint, the absence of explicit permission declarations and enforcement increases the risk of unintended file access, secret exposure, or exfiltration if the script behavior differs from the documentation or is modified.

Static analysis

No suspicious patterns detected.