ClawHub
Back to skill

Security audit

Image 2 多参考图生成

Security checks across malware telemetry and agentic risk

Overview

The skill appears purpose-aligned for AI Hive image generation, but its setup asks users to pass an API key on the command line without warning about exposure risks.

Review this before installing if your AI Hive account is sensitive. Prefer setting AI_HIVE_API_KEY or a protected config file instead of pasting the API key into a command, and only use reference images you are comfortable uploading to AI Hive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill documentation instructs users to run a local Python script that can read files, write files, access environment variables, invoke shell commands, and make network requests, yet the skill declares no permissions. This creates a transparency and consent problem: users and hosting platforms cannot accurately assess or constrain what the skill is capable of doing before execution.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The setup command passes the API key directly as a command-line argument, which can be exposed through shell history, terminal logging, process listings, or developer tooling. If another local user, monitoring agent, or log collector captures that command, the secret can be reused to access the associated API account.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.