ClawHub
Back to skill

Security audit

Seedream 5.0 Lite 图生图

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed image-editing helper that uploads user-selected reference images to a fixed AI Hive API and saves generated results locally.

Install only if you are comfortable sending the reference images you choose to AI Hive and storing an AI Hive API key locally. Review images for privacy, rights, brands, people, and evidentiary/news sensitivity before upload.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill invokes a Python script that can read environment variables, read/write local files, access the network, and execute shell commands, but it declares no permissions or capability boundaries in a machine-enforceable way. This creates a trust gap: users or orchestration systems may treat the skill as low-risk while it can upload images, persist credentials, and interact with external services.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.