ClawHub
Back to skill

Security audit

商品详情页套图一键生成

Security checks across malware telemetry and agentic risk

Overview

This skill uses an external image service to generate product-detail-page images from prompts and selected reference images, with no evidence of hidden or destructive behavior.

Install only if you are comfortable sending product prompts and approved reference images to AI Hive. Treat proprietary product images as externally shared, review the provider's retention terms, and use --output-dir if you do not want generated files saved under ~/Downloads/AiHive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill advertises shell, file, environment, and network-capable commands but declares no permissions, which creates a transparency and sandboxing problem. A caller or reviewer cannot accurately assess what data may be read, written, or transmitted, and the commands shown can send local images and possibly secrets-derived configuration to a remote service.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented behavior exceeds the stated purpose by enabling more general image-generation operations, separate API-key setup, task querying, and reference-image upload workflows. That mismatch is dangerous because users may invoke the skill believing it only performs narrowly scoped PDP image-set generation, while it can actually transmit arbitrary prompts and user-provided images to a third-party API.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill states that results are saved and that requests go to an external API, but it does not disclose output locations, retention behavior, or that approved reference images may be transmitted off-device. This is dangerous because users may unintentionally expose proprietary product images or other sensitive assets without informed consent or knowledge of where artifacts are stored.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.