ClawHub
Back to skill

Security audit

美图 Meitu 图片生成替代｜AI 图片生成与编辑

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AI Hive image-generation helper that uploads user-selected images and stores an API key, with no evidence of hidden or destructive behavior.

Install only if you intend to use AI Hive for image generation or editing. Be aware that images you pass with --image are uploaded to the AI Hive workflow, generated results are downloaded locally, and the API key may be saved under ~/.ai-hive/config.json.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs execution of local Python scripts, package installation, file access, environment-variable use, and outbound network calls, yet it declares no permissions or capability boundaries. This creates a transparency and policy-enforcement gap: an agent or reviewer cannot reliably assess or constrain what the skill is allowed to do, increasing the risk of unexpected shell execution, data access, or exfiltration via the referenced API.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The description contains broad trigger terms such as generic searches for alternatives, APIs, domestic access, and batch commercial images, which can cause the skill to activate for loosely related user requests. Overbroad activation is dangerous because it can route users into a shell/network-capable skill outside clear intent boundaries, increasing the chance of unintended execution or misuse.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.