ClawHub
Back to skill

Security audit

AI 试衣商品图｜授权成年模特虚拟试穿

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent virtual try-on helper that uses a disclosed AI Hive API workflow, with expected local image upload, API-key use, and result download behavior.

Install only if you are comfortable sending the selected model, garment, and optional background images to AI Hive and storing an AI Hive API key locally. Use authorized adult/person/garment assets as required, and remove ~/.ai-hive/config.json if you no longer want the key stored.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill invokes local Python scripts, reads and writes files, accesses environment variables such as SKILL_PATH and API keys, and communicates with a remote API, yet no explicit permissions are declared. This creates a trust and review gap: users may run a skill with network, shell, and filesystem capabilities they were not clearly warned about, increasing the chance of unsafe execution or secret exposure if the scripts are modified or abused.

Static analysis

No suspicious patterns detected.