ClawHub
Back to skill

Security audit

GPT Image 2 广告图片

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent AI Hive image-generation helper, with expected API key, upload, network, and output-file behavior for ad image creation.

Install only if you are comfortable giving AI Hive an API key and uploading the reference images you choose. Review the default output location and avoid passing sensitive local files as --image or --file inputs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill documentation invokes local scripts with package installation, shell execution, network access, and file I/O, yet no explicit permissions are declared. This creates a transparency and least-privilege problem: users may trust a simple ad-image skill while it can access environment variables, local files, and the network during execution.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding
The stated purpose is narrowly scoped to GPT Image 2 ad creative generation, but the referenced tooling reportedly supports unrelated high-risk capabilities such as model enumeration, user/wallet queries, uploads, browser-based API-key setup, task retrieval, and even video or chat workflows. This mismatch is dangerous because it expands the attack surface and can mislead users into authorizing broader actions than expected, including access to credentials, account data, and external services.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.