ClawHub
Back to skill

Security audit

Walmart 电商图片生成与编辑

Security checks for vulnerabilities and agentic risk

Overview

This skill is a purpose-aligned Walmart product image generator, with expected external AI-service access and local API-key storage that users should understand before use.

Use this skill only if you are comfortable sending selected product/reference images and prompts to AI Hive. Treat the AI Hive API key as a real credential, keep it revocable, and review generated images against Walmart Marketplace and merchant-approved product facts before publishing.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill advertises shell, network, environment, and file access through documented commands, yet no explicit permission declaration is present. This weakens sandboxing and user/operator awareness, increasing the chance that a skill invoking external endpoints, reading local files, or writing credentials runs with broader access than expected.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented purpose is narrow retail image generation, but the underlying behavior reportedly includes generic text/video model access, account and wallet queries, model discovery, browser-based API-key setup, and local credential storage. This mismatch is dangerous because users and policy engines may authorize the skill for image editing while it can perform broader external actions, expose account metadata, and persist secrets on disk.

Static analysis

No suspicious patterns detected.