ClawHub
Back to skill

Security audit

PhotoRoom 图片生成替代｜AI 图片生成与编辑

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AI image-editing helper that sends user-chosen product images and prompts to AI Hive and saves generated results locally.

Install only if you are comfortable sending selected images, prompts, and an AI Hive API key to the disclosed AI Hive endpoint. Avoid using it on sensitive product photos unless that provider is acceptable for your workflow.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises executable commands that use shell, local files, environment variables, and outbound network access, yet no permissions are declared. This creates a transparency and governance gap: an agent or reviewer may underestimate the skill’s actual capabilities, increasing the risk of unintended file access, command execution, or data egress to the external API endpoint.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The trigger terms are broad and ambiguous, covering generic image-editing and e-commerce-photo queries rather than a narrowly scoped use case. Over-broad activation can cause the skill to run in unintended contexts, exposing user images or prompts to an external service when the user did not specifically intend to invoke this skill.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.