ClawHub
Back to skill

Security audit

GPT Image 2 图生图

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent image-to-image helper that uploads user-selected reference images to a fixed AI Hive API and stores its API key locally with disclosed file permissions.

Install only if you are comfortable sending selected reference images and prompts to AI Hive, storing an AI Hive API key locally, and downloading generated outputs to your machine. Use only images you have rights to upload.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill invokes a local Python script with network, file read/write, environment, and shell capabilities, but does not declare corresponding permissions. This creates a transparency and review gap: operators may approve or run the skill without understanding that it can store API keys locally, upload files, contact external services, and write downloaded outputs.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.