ClawHub
Back to skill

Security audit

直播带货图片

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed AI image-generation helper that uses an AI Hive API key and user-selected images, with no hidden or destructive behavior found.

Install only if you are comfortable using AI Hive for this workflow. Prompts and any reference images you choose are sent to the service or its upload storage, and the tool may store an API key in ~/.ai-hive/config.json with restricted permissions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The manifest description and primary instructions are written as fixed Chinese-language guidance for the skill, and there is no indication that users may choose another language or locale. This can violate a language/locale policy when a skill imposes one language by default without explicit opt-in.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The module docstring and all user-facing prompts/messages are written exclusively in Chinese, and the skill does not provide any language selection or opt-in. Under the stated policy, forcing a specific language without user choice is a natural-language policy violation unless the locale constraint is clearly justified, which is not documented here.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def _resolve_api_key(self, cli_key):
        if cli_key:
            return cli_key
        env_key = os.environ.get("AI_HIVE_API_KEY")
        if env_key:
            return env_key
        file_config = self._read_config_file()
Confidence
70% confidence
Finding
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def _try_read_existing_api_key():
    """安全读取已配置的 API Key，失败返回 None。"""
    env_key = os.environ.get("AI_HIVE_API_KEY")
    if env_key:
        return env_key
    try:
Confidence
70% confidence
Finding
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.