ClawHub
Back to skill

Security audit

FLUX 图片生成替代｜AI 图片生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed AI Hive image generation helper that uploads user-chosen prompts and images to a fixed remote service and stores a local API key for that purpose.

Install only if you are comfortable sending the prompts and explicitly selected reference images to AI Hive/object storage. Use a dedicated AI Hive API key if possible and review ~/.ai-hive/config.json if you later want to remove the stored credential.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill invokes shell commands, reads and writes local files, accesses environment variables, and performs network requests, yet no permissions are declared. This creates a transparency and policy gap: a caller or platform may treat the skill as low-risk while it can upload images, use API keys from the environment, and write artifacts locally. In this context, the risk is elevated because the skill explicitly interacts with a remote API and handles user-provided images and prompts, which can expose sensitive data if operators are unaware of its effective capabilities.

Static analysis

No suspicious patterns detected.